Signatures Reference Guide Version 6.5 Internet Security Systems, Inc. 6303 Barfield Road Atlanta, Georgia 30328-4233 United States (404) 236-2600 http://www.iss.net © Internet Security Systems, Inc. 1998-2001. All rights reserved worldwide. Customers may make reasonable numbers of copies of this publication for internal use only. This publication may not otherwise be copied or reproduced, in whole or in part, by any other person or entity without the express prior written consent of Internet Security Systems, Inc. Patents pending. Internet Security Systems, the Internet Security Systems logo, The Power To Protect, X-Force, ADDME, Internet Scanner, System Scanner, Database Scanner, ActiveAlert, X-Press Update, FlexCheck, SecurePartner, SecureU, Secure Steps, and RealSecure are trademarks and service marks, and SAFEsuite a registered trademark, of Internet Security Systems, Inc. Network ICE, ICEpac, and ICEcap are trademarks, and BlackICE is a licensed trademark, of Network ICE Corporation, a wholly owned subsidiary of Internet Security Systems, Inc. SilentRunner is a registered trademark of Raytheon Company. Acrobat and Adobe are registered trademarks of Adobe Systems Incorporated. Certicom is a trademark and Security Builder is a registered trademark of Certicom Corp. Check Point, FireWall-1, OPSEC, Provider-1, and VPN-1 are registered trademarks of Check Point Software Technologies Ltd. or its affiliates. Cisco and Cisco IOS are registered trademarks of Cisco Systems, Inc. HP-UX and OpenView are registered trademarks of Hewlett-Packard Company. IBM and AIX are registered trademarks of IBM Corporation. Intel and Pentium are registered trademarks of Intel. Lucent is a trademark of Lucent Technologies, Inc. ActiveX, Microsoft, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation. Net8, Oracle, Oracle8, SQL*Loader, and SQL*Plus are trademarks or registered trademarks of Oracle Corporation. Seagate Crystal Reports, Seagate Info, Seagate, Seagate Software, and the Seagate logo are trademarks or registered trademarks of Seagate Software Holdings, Inc. and/or Seagate Technology, Inc. Secure Shell and SSH are trademarks or registered trademarks of SSH Communications Security. iplanet, Sun, Sun Microsystems, the Sun Logo, Netra, SHIELD, Solaris, SPARC, and UltraSPARC are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the United States and other countries. Adaptive Server, SQL, SQL Server, and Sybase are trademarks of Sybase, Inc., its affiliates and licensers. Tivoli is a registered trademark of Tivoli Systems Inc. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company, Ltd. All other trademarks are the property of their respective owners and are used here in an editorial context without intent of infringement. Specifications are subject to change without notice. Copyright © Sax Software (terminal emulation only). Disclaimer: The information contained in this document may change without notice, and may have been altered or changed if you have received it from a source other than ISS or the X-Force. Use of this information constitutes acceptance for use in an “AS IS” condition, without warranties of any kind, and any use of this information is at the user’s own risk. ISS and the X-Force disclaim all warranties, either expressed or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall ISS or the X-Force be liable for any damages whatsoever, including direct, indirect, incidental, consequential or special damages, arising from the use or dissemination hereof, even if ISS or the X-Force has been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Internet Security Systems, Inc. The views and opinions of authors expressed herein do not necessarily state or reflect those of Internet Security Systems, Inc., and shall not be used for advertising or product endorsement purposes. Links and addresses to Internet resources are inspected thoroughly prior to release, but the ever-changing nature of the Internet prevents Internet Security Systems from guaranteeing the content or existence of the resource. When possible, the reference contains alternate sites or keywords that could be used to acquire the information by other methods. If you find a broken or inappropriate link, please send an email with the topic name, link, and its behavior to support@iss.net. December 2001 Internet Security Systems, Inc. Software License Agreement THIS SOFTWARE IS LICENSED, NOT SOLD. BY INSTALLING THIS SOFTWARE, YOU AGREE TO ALL OF THE PROVISIONS OF THIS SOFTWARE LICENSE AGREEMENT (“LICENSE”). IF YOU ARE NOT WILLING TO BE BOUND BY THIS LICENSE, RETURN ALL COPIES OF THE SOFTWARE AND LICENSE KEYS TO ISS WITHIN FIFTEEN (15) DAYS OF RECEIPT FOR A FULL REFUND OF ANY PAID LICENSE FEE. IF THE SOFTWARE WAS OBTAINED BY DOWNLOAD, YOU MAY CERTIFY DESTRUCTION OF ALL COPIES AND LICENSE KEYS IN LIEU OF RETURN. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. License - Upon payment of the applicable fees, Internet Security Systems, Inc. (“ISS”) grants to you as the only end user (“Licensee”) a nonexclusive and nontransferable, limited license for the accompanying ISS software product in machine-readable form and the related documentation (“Software”) for use only on the specific network configuration, for the number of devices, and for the time period (“Term”) that are specified in Licensee’s purchase order, as accepted by ISS, and the invoice and license key furnished by ISS. ISS limits use of Software based upon the number and type of devices upon which it may be installed, used, gather data from, or report on, depending upon the specific Software licensed. A device includes any network addressable device connected to Licensee’s network, including remotely, including but not limited to personal computers, workstations, servers, routers, hubs and printers. Licensee may reproduce, install and use the Software on multiple devices, provided that the total number and type are authorized in Licensee’s purchase order, as accepted by ISS, and the invoice and license key furnished by ISS. Licensee may make a reasonable number of backup copies of the Software solely for archival and disaster recovery purposes. If Software is ISS’ SAFEsuite Decisions product, then it is delivered with Seagate Info, a third party software product of Seagate Software Information Management Group Holdings, Inc. Seagate Info is restricted to use with ISS SAFEsuite Decisions and no other application. A license of ISS SAFEsuite Decisions allows Licensee to implement up to three (3) copies of SAFEsuite Decisions of which one (1) of these copies may be for production use. Each Seagate Info license includes ten (10) “Client” licenses and one (1) Report/Query Add-In “Designer” license. Additional copies require additional licenses. Seagate Info is subject to the terms and conditions of the license agreement accompanying such software. ISS will provide to Licensee, upon request and in any event upon delivery of such software, copies of licensing documentation applicable to such software. Seagate Info is supplied by ISS “AS IS”, without any warranties of ISS whatsoever. Covenants - ISS reserves all intellectual property rights in the Software. Licensee agrees: (a) the Software is owned by ISS and/or its licensors, is a valuable trade secret of ISS, and is protected by copyright laws and international treaty provisions; (b) to take all reasonable precautions to protect the Software from unauthorized access, disclosure, copying or use; (c) not to modify, adapt, translate, reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code of the Software; (d) not to use ISS trademarks; (e) to reproduce all of ISS’ and its licensors’ copyright notices on any copies of the Software; (f) not to transfer, lease, assign, sublicense, or distribute the Software or make it available for timesharing, service bureau, or on-line use; and (g) not to disseminate performance information or analysis (including without limitation benchmarks) from any source relating to the Software. Support and Maintenance - During the term for which Licensee has paid the applicable support and maintenance fees, ISS will, upon request, provide software maintenance and support services that it makes generally available under its then current Maintenance and Support Policy. Support and maintenance include telephone support and electronic delivery to Licensee of error corrections and updates to the Software (but NOT new releases or products that substantially increase functionality and are marketed separately) and documentation as described in ISS’ then current Maintenance & Support Policy. Limited Warranty - The commencement date of this limited warranty is the date on which ISS furnishes to Licensee the license key for the Software. For a period of ninety (90) days after the commencement date or for the Term (whichever is less), ISS warrants that the Licensed Software will conform to material operational specifications described in its then current documentation. However, this limited warranty shall not apply unless (i) the Software is installed, implemented, and operated in accordance with all written instructions and documentation supplied by ISS, (ii) Licensee notifies ISS in writing of any nonconformity within the warranty period, and (iii) Licensee has promptly and properly installed all corrections, new versions, and updates made available by ISS to Licensee. Furthermore, this limited warranty shall not apply to nonconformities arising from any of the following: (i) misuse of the Software, (ii) modification of the Software, (iii) failure by Licensee to utilize compatible computer and networking hardware and software, or (iv) interaction with software or firmware not provided by ISS. If Licensee timely notifies ISS in writing of any such nonconformity, then ISS shall repair or replace the Software or, if ISS determines that repair or replacement is impractical, ISS may terminate the applicable licenses and refund the applicable license fees, as the sole and exclusive remedies of Licensee for such nonconformity. THIS WARRANTY GIVES LICENSEE SPECIFIC LEGAL RIGHTS, AND LICENSEE MAY ALSO HAVE OTHER RIGHTS THAT VARY FROM JURISDICTION TO JURISDICTION. ISS DOES NOT WARRANT THAT THE SOFTWARE WILL MEET LICENSEE’S REQUIREMENTS, THAT THE OPERATION OF THE SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT ALL SOFTWARE ERRORS WILL BE CORRECTED. LICENSEE UNDERSTANDS AND AGREES THAT LICENSED SOFTWARE IS NO GUARANTEE AGAINST INTRUSIONS, VIRUSES, TROJAN HORSES, WORMS, TIME BOMBS, CANCELBOTS OR OTHER SIMILAR HARMFUL OR DELETERIOUS PROGRAMMING ROUTINES AFFECTING LICENSEE’S NETWORK, OR THAT ALL SECURITY THREATS AND VULNERABILITIES WILL BE DETECTED OR THAT THE PERFORMANCE OF THE LICENSED SOFTWARE WILL RENDER LICENSEE’S SYSTEMS INVULNERABLE TO SECURITY BREACHES. THE REMEDIES SET OUT IN THIS SECTION 4 ARE THE SOLE AND EXCLUSIVE REMEDIES FOR BREACH OF THIS LIMITED WARRANTY. Warranty Disclaimer - EXCEPT FOR THE LIMITED WARRANTY PROVIDED ABOVE, THE SOFTWARE IS PROVIDED “AS IS” AND ISS HEREBY DISCLAIMS ALL WARRANTIES, BOTH EXPRESS AND IMPLIED, INCLUDING IMPLIED WARRANTIES RESPECTING MERCHANTABILITY, TITLE, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. SOME JURISDICTIONS DO NOT ALLOW DISCLAIMERS OF IMPLIED WARRANTIES, SO THE ABOVE LIMITATION MAY NOT APPLY TO LICENSEE. LICENSEE EXPRESSLY ACKNOWLEDGES THAT NO REPRESENTATIONS OTHER THAN THOSE CONTAINED IN THIS LICENSE HAVE BEEN MADE REGARDING THE GOODS OR SERVICES TO BE PROVIDED HEREUNDER, AND THAT LICENSEE HAS NOT RELIED ON ANY REPRESENTATION NOT EXPRESSLY SET OUT IN THIS LICENSE. Proprietary Rights - ISS represents and warrants that ISS has the authority to license the rights to the Software that are granted herein. ISS shall defend and indemnify Licensee from any final award of costs and damages against Licensee for any actions based on infringement of any U.S. copyright, trade secret, or patent as a result of the use or distribution of a current, unmodified version of the Software; but only if ISS is promptly notified in writing of any such suit or claim, and only if Licensee permits ISS to defend, compromise, or settle same, and only if Licensee provides all available information and reasonable assistance. The foregoing is the exclusive remedy of Licensee and states the entire liability of ISS with respect to claims of infringement or misappropriation relating to the Software. Limitation of Liability - Licensee acknowledges that some of the Software is designed to test the security of computer networks and may disclose or create problems in the operation of the systems tested. Licensee accepts the risk of such possibility and hereby waives all rights, remedies, and causes of action against ISS and releases ISS from all liabilities arising therefrom. ISS’ ENTIRE LIABILITY FOR MONETARY DAMAGES ARISING OUT OF THIS LICENSE SHALL BE LIMITED TO THE AMOUNT OF THE LICENSE FEES ACTUALLY PAID BY LICENSEE UNDER THIS LICENSE, PRORATED OVER A THREE-YEAR TERM FROM THE DATE LICENSEE RECEIVED THE SOFTWARE. IN NO EVENT SHALL ISS BE LIABLE TO LICENSEE UNDER ANY THEORY INCLUDING CONTRACT AND TORT (INCLUDING NEGLIGENCE AND STRICT PRODUCTS LIABILITY) FOR ANY SPECIAL, PUNITIVE, INDIRECT, INCIDENTAL OR CONSEQUENTIAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, COSTS OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, DAMAGES FOR LOST PROFITS, LOSS OF DATA, LOSS OF USE, OR COMPUTER HARDWARE MALFUNCTION, EVEN IF ISS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Termination - Licensee may terminate this License at any time by notifying ISS in writing. All rights granted under this License will terminate immediately, without prior written notice from ISS, at the end of the term of the license, if not perpetual. If Licensee fails to comply with any provisions of this License, ISS may immediately terminate this License if such default has not been cured within ten (10) days following written notice of default to Licensee. Upon termination or expiration of the License, Licensee shall cease all use of the Software and destroy all copies of the Software and associated documentation. Termination of this License shall not relieve Licensee of its obligation to pay all fees incurred prior to such termination and shall not limit either party from pursuing any other remedies available to it. General Provisions - This License, together with the identification of the Software, pricing and payment terms stated in the applicable Licensee purchase order as accepted by ISS and ISS invoice and license key, constitute the entire agreement between the parties respecting its subject matter. Standard and other additional terms or conditions contained in any purchase order or similar document are hereby expressly rejected and shall have no force or effect. This License will be governed by the substantive laws of the State of Georgia, USA, excluding the application of its conflicts of law rules. This License will not be governed by the United Nations Convention on Contracts for the International Sale of Goods, the application of which is expressly excluded. If any part of this License is found void or unenforceable, it will not affect the validity of the balance of the License, which shall remain valid and enforceable according to its terms. This License may only be modified in writing signed by an authorized officer of ISS. Notice to United States Government End Users - Licensee acknowledges that any Software furnished under this License is commercial computer software developed at private expense and is provided with RESTRICTED RIGHTS. Any use, modification, reproduction, display, release, duplication or disclosure of this commercial computer software by the United States Government or its agencies is subject to the terms, conditions and restrictions of this License in accordance with the United States Federal Acquisition Regulations at 48 C.F.R. Section 12.212 and Subsection 227.7202-3 or applicable subsequent regulations. Contractor/manufacturer is Internet Security Systems, Inc., 6303 Barfield Road, Atlanta, GA 30328, USA. Export and Import Controls; Use Restrictions - Licensee will not transfer, export, or reexport the Software, any related technology, or any direct product of either except in full compliance with the export controls administered by the United States and other countries and any applicable import and use restrictions. Licensee agrees that it will not export or reexport such items to anyone on the U.S. Treasury Department’s list of Specially Designated Nationals or the U.S. Commerce Department’s Denied Persons List or Entity List, or to any country to which the United States has embargoed goods, or for use with chemical or biological weapons, sensitive nuclear end-uses, or missiles. Licensee represents and warrants that it is not located in, under control of, or a national or resident of any such country or on any such list. Many ISS software products include encryption and export outside of the United States or Canada is strictly controlled by U.S. laws and regulations. Please contact ISS’ Customer Operations for export classification information relating to the Software (customer_ops@iss.net). Licensee understands that the foregoing obligations are U.S. legal requirements and agrees that they shall survive any term or termination of this License. Authority - Because the Software is designed to test or monitor the security of computer network systems and may disclose or create problems in the operation of the systems tested, Licensee and the persons acting for Licensee represent and warrant that: (a) they are fully authorized by the Licensee and the owners of the computer network for which the Software is licensed to enter into this License and to obtain and operate the Software in order to test and monitor that computer network; (b) the Licensee and the owners of that computer network understand and accept the risks involved; and (c) the Licensee shall procure and use the Software in accordance with all applicable laws, regulations and rules. 13. No High Risk Use - Licensee acknowledges that the Software is not fault tolerant and is not designed or intended for use in hazardous environments requiring fail-safe operation, including, but not limited to, aircraft navigation, air traffic control systems, weapon systems, life-support systems, nuclear facilities, or any other applications in which the failure of the Licensed Software could lead to death or personal injury, or severe physical or property damage. ISS disclaims any implied warranty of fitness for High Risk Use. Revised October 22, 2001 Maintenance Services Policy Statement Internet Security Systems, Inc., a Georgia Corporation ("ISS"), provides Maintenance Services to customers who have been offered the opportunity by ISS to purchase these services and have paid the applicable current support and maintenance fees. Maintenance Services include telephone support, error corrections, and software and documentation updates. DEFINITIONS Capitalized terms used in this Policy Statement and not otherwise defined shall have the same meaning as set forth in the body of the End-User License Agreement (EULA). "Error" - a situation where the Licensed Software does not function in accordance with the documentation. "Fix" - the repair or replacement of binary or executable code versions of the Licensed Software to remedy an Error. "Workaround - a change in the procedures followed by the Licensee to avoid an Error without substantially impairing use of the Software. 1. 1.1. 1.2. 1.3. TELEPHONE and EMAIL SUPPORT Telephone and email support on the installation and use of the Software is available 24 hours a day, every day. Installation support includes answering questions and providing a reasonable level of guidance to the Licensee on the installation process. Usage support includes answering questions and providing a reasonable level of guidance to the Licensee about the use of the Software, responding to reports of errors in the Software and determining if the reported error is a result of a problem in the Software or an environmental or installation problem. The Licensee is responsible for providing documentation sufficient for ISS to reproduce the Error on its master copy of the Software including a written, detailed description of the problem, log files, core dumps, data files, or any other information requested by ISS. 2. ERROR CORRECTIONS 2.1. ISS is responsible for using commercially reasonable efforts during normal support hours to correct Errors in the current version of the Software in a timely manner by providing the repair or replacement of object or executable code versions of the Software. 2.2. PRIORITY 1 - CRITICAL ERRORS - A critical priority error renders the software inoperable or causes the Software to substantially fail. Examples of Critical Priority Errors may include: blue screen, file corruption, or program hangs and requires reboot. ISS will use commercially reasonable efforts to: a.) assign ISS software engineers to correct the error within twenty-four (24) business hours of ISS determining that a Critical error exists, b.) provide Licensee with frequent reports on the status of the corrections, c.) provide Licensee with a workaround or fix within (10) business days and, d.) to include the Fix for the Error in the next major release of the Software. 2.3. PRIORITY 2 - HIGH ERRORS - A High Priority Error substantially degrades the performance and/or causes serious limitations in the use of the Software. Examples of High Priority Errors may include: problem results in lack of functionality and major inconvenience for customers, workaround quite difficult to implement, or prevents other areas of the product from functioning as expected. ISS will use commercially reasonable efforts to: a.) assign ISS software engineers to correct the error within ten (10) business days of ISS determining that a High Priority error exists, b.) provide Licensee with periodic reports on the status of the corrections, c.) provide Licensee with a workaround or fix within (30) business days and, d.) to include the Fix for the Error in the next major release of the Software. 2.4. PRIORITY 3 - MEDIUM ERRORS - A medium priority error has minor impact on overall product use. Examples of Medium Priority Errors may include: content is formatted/represented incorrectly and, work around exists - but still a bug. ISS will use commercially reasonable efforts to include the Fix for the Error in the next major release of the Software. 2.5. PRIORITY 4 - LOW ERRORS - A low priority error is any other error in the Software. Low Priority Errors are typically cosmetic in nature (i.e. spelling, punctuation, etc.). ISS will use commercially reasonable efforts to include the Fix for the Error in a future release of the Software. 2.6. PRIORITY 5 - ENHANCEMENT REQUESTS - any new feature requests. All enhancements requests are submitted to marketing for consideration in a future release of the Software. 2.7. Errors not caused by the Software. If ISS reasonably believes that a problem reported by Licensee may not be due to an Error in the Software ISS will so notify Licensee, and ISS shall not proceed further, unless so instructed in writing by Licensee. If upon resolution of the problem it is determined that Error is not a result of an Error in the Software, the Customer will be invoiced for time and materials at ISS's then standard rates for the time spent in the resolution process. 2.8. No Support of Altered Versions of the Software. ISS shall have no obligation to correct Errors or provide telephone support on any version of the Software that has been altered or modified by the Licensee. 3. SOFTWARE AND DOCUMENTATION UPDATES 3.1. ISS shall make available to the Licensee upgrades, improvements and modifications to the Software such as improvements in use and usability and new vulnerability checks. ISS will provide to Licensee all such upgrades, improvements or modifications of the Software that ISS makes generally available to other ISS customer and does not market as independent products or modules. Contents 3Com AirConnect Access Point "Accepts Broadcast Wireless LAN Service Area" feature is enabled (SNMP_Suspicious_Set) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 3Com AirConnect Access Point "Access Control" function is disabled (SNMP_Suspicious_Set) . . . . . . . . . 2 3Com AirConnect Access Point Access Control Violation Trap is disabled (SNMP_Suspicious_Set) . . . . . . 3 3Com AirConnect Access Point ships with default wireless LAN Service Area ID (SNMP_Suspicious_Set) . 4 3Com AirConnect Access Point telnet logins enabled (SNMP_Suspicious_Set). . . . . . . . . . . . . . . . . . . . 5 VTCP.386 is out of date (Land) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Account policy was changed (Account_policy_change) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Security identifier failed to be written to Windows 2000 security principal sIDHistory (Add_SID_failure) . . . 8 Security identifier added to Windows 2000 security principal sIDHistory (Add_SID_success) . . . . . . . . . . 9 RPC admind insecure authentication (Admind) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 IBM C Set ++ pdnsd for AIX contains a remotely exploitable buffer overflow (AIX_Pdnsd_BO) . . . . . . . . . 11 Allaire JRun Server JSP files could be executed as JSP scripts on the server (Allaire_JRun_JSP_Execute) 12 Allaire JRun 2.3.x sample files allow remote access (Allaire_JRun_Sample_Files). . . . . . . . . . . . . . . . . 13 Allaire JRun Server SSIFilter with malformed URL could be used to access files (Allaire_JRun_SSIFilter) . 14 Allaire JRun allows file access using malformed WEB-INF directory request (Allaire_JRun_WebInf_DotSlash) 15 Allaire JRun Server could allow unauthorized access to WEB-INF directory (Allaire_JRun_WebInf_SlashSlash) 15 Automounter daemon buffer overflow can lead to remote root access (Amd_Overflow). . . . . . . . . . . . . 16 Automounter daemon can be remotely queried for its process ID (Amd_Pid). . . . . . . . . . . . . . . . . . . . 18 Automounter daemon allows users to remotely query for system information (Amd_Version). . . . . . . . . 20 Solaris AnswerBook2 administration interface (AnswerBook2_Admin) . . . . . . . . . . . . . . . . . . . . . . . . 22 Solaris AnswerBook2 Web interface could allow remote execution (AnswerBook2_Execute) . . . . . . . . . 23 L0pht AntiSniff ARP test detected (AntiSniff_ARP_Test) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 L0pht AntiSniff DNS test detected (AntiSniff_DNS_Test). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 AOL Admin backdoor for Windows and AOL (AolAdmin) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 ARP host down detection (Arp) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Ascend and 3Com router malformed TCP packet denial of service (Ascend_Kill) . . . . . . . . . . . . . . . . . 28 Asylum RAT (Remote Access Tool) backdoor for Windows (Asylum) . . . . . . . . . . . . . . . . . . . . . . . . . 29 Audit log manually cleared by a user with appropriate privileges (Audit_log_cleared) . . . . . . . . . . . . . . . 30 Audit policy settings changed manually (Audit_policy_change) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Authentication package load (Authentication_package_loaded) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Authentication ticket granted to a Windows 2000 security principal (Authentication_ticket_granted) . . . 32 Authentication ticket request failed (Authentication_ticket_request_failed) . . . . . . . . . . . . . . . . . . . . . . 33 BackConstruction backdoor for Windows (BackConstruction) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Backdoor2 for Windows (BackDoor2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Back Orifice default installation (BackOrifice) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Back Orifice 2000 allows complete remote administrative control (BackOrifice2000) . . . . . . . . . . . . . . 36 BigGluck backdoor for Windows (BigGluck) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 BIND Inverse-Query buffer overflow allows remote root access (DNS_Length_Overflow) . . . . . . . . . . . . 38 BIND servers can be remotely queried for their version numbers (Bind_Version_Request). . . . . . . . . . . 40 Blazer5 backdoor for Windows 95/98 and NT (Blazer5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Bootpd remote buffer overflow (Bootp_Remote_Overflow). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Bootparamd whoami (Bootparam) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Brute force login attack attempted (Brute_force_login_attack) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Brute force login attack most likely successful (Brute_force_login_likely_successful) . . . . . . . . . . . . . . . 44 Bugs backdoor for Windows 95/98 and NT (Bugs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 vii Contents C2 auditing is disabled (C2_AUDIT_IS_OFF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Password change attack attempted (Change_password_attack) . . . . . . . . . . . . . . . . . . . . . . . Password change attack possibly successful (Change_password_attack_likely_successful) . . . . . . Executable, system file, or other file modified (Changes_to_important_files). . . . . . . . . . . . . . . . Chargen patch not applied (Chargen_Denial_of_Service) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chargen denial of service (Chargen_Denial_of_Service) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . AUE_CHMOD or AUE_FCHMOD calls success and setuid bit is being turned on (Chmod_setuid) . . Chupacabra backdoor for Windows (Chupacabra). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cisco Aironet Access Point Broadcast SSID (SNMP_Suspicious_Set) . . . . . . . . . . . . . . . . . . . . Cisco land denial of service (Land) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cisco equipment can be used to send ICMP pings through SNMP (SNMP_Suspicious_Get) . . . . . Cisco IOS "cable-docsis" community string (Cisco_Cable_Docsis_SNMP_Community). . . . . . . . . . Cisco Catalyst switches can be remotely crashed (Cisco_CR_DoS). . . . . . . . . . . . . . . . . . . . . . Cisco equipment identifies itself with packets returned from port 1999 (Cisco_Ident) . . . . . . . . . Cisco IOS hidden ILMI community string could allow modification of SNMP objects (Cisco_ILMI_SNMP_Community) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cisco IOS can be remotely crashed by invalid UDP packet (Cisco_Syslog_DoS) . . . . . . . . . . . . . . Coma backdoor for Windows 95/98 (Coma). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Compaq Web-Based Management buffer overflow (Compaq_Insight_Cpqlogin_Overflow) . . . . . . . Compaq Management Agent denial of service (Compaq_Insight_DoS). . . . . . . . . . . . . . . . . . . . Compaq Insight Management Agent allows remote retrieval of files (Compaq_Insight_Fileread) . . Windows 2000 computer account changed (Computer_account_changed) . . . . . . . . . . . . . . . Windows 2000 computer account created (Computer_account_created). . . . . . . . . . . . . . . . . Windows 2000 computer account deleted (Computer_account_deleted) . . . . . . . . . . . . . . . . . Config file change failed (Config-log_files_delete_failed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Config-log files deleted (Config-log_files_deleted) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Connection backdoor for Windows 95/98 (Connection_Backdoor) . . . . . . . . . . . . . . . . . . . . . Process created core file; effective UID is root, real id is non-root (Core_event_setuid) . . . . . . . . CrazzyNet backdoor for Windows (CrazzyNet) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CyberCop Scanner is a commercial network vulnerability auditing tool (CyberCop_Scanner) . . . . . Unauthorized attempt to start DCOM server with DefaultLaunchPermission (dcomdef_deny) . . . . Unauthorized attempt to start DCOM server (dcomsrv_deny) . . . . . . . . . . . . . . . . . . . . . . . . . Invalid packet with all TCP options set (IPProtocolViolation) . . . . . . . . . . . . . . . . . . . . . . . . . . . DeepThroat backdoor for Windows (DeepThroat) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Deltasource backdoor for Windows (DeltaSource) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RealSecure sensor error message (Detector_Error) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RealSecure sensor information message (Detector_Info) . . . . . . . . . . . . . . . . . . . . . . . . . . . . RealSecure sensor warning message (Detector_Warning) . . . . . . . . . . . . . . . . . . . . . . . . . . . Devil backdoor for Windows (Devil) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DG/UX finger shell metacharacters allowed (Finger_Perl) . . . . . . . . . . . . . . . . . . . . . . . . . . . DHCP Ack from server to client (DHCP_Ack) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Client broadcasts DHCP Discover messages to locate available servers (DHCP_Discover) . . . . . . Client DHCP Request (DHCP_Request) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Disk space at or near capacity (Disk_space_shortage) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DNS request made for all records (DNS_All) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Microsoft DNS Server - excessive bad packets received (dns_bad_pkts) . . . . . . . . . . . . . . . . . . Microsoft DNS Server - CNAME loop during caching (dns_cname). . . . . . . . . . . . . . . . . . . . . . DNS HINFO request (DNS_HInfo) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DNS hostname exceeding maximum length (DNS_Hostname_Overflow) . . . . . . . . . . . . . . . . . . Microsoft DNS Server - Invalid domain name (dns_inv_dom) . . . . . . . . . . . . . . . . . . . . . . . . . . Microsoft DNS Server - Invalid domain name offset in DNS message packet (dns_inv_dom_offset) Microsoft DNS Server - Invalid domain name in DNS message packet (dns_inv_dom_pkt) . . . . . . Microsoft DNS Server - Invalid DNS UPDATE message in DNS packet (dns_inv_updated) . . . . . . DNS server inverse queries (DNS_Iquery) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Overflowing DNS IPv4 length allows attackers to gain access (DNS_Length_Overflow). . . . . . . . . viii . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. .. .. .. .. .. .. .. .. .. .. .. .. .. . . . . . . . . . . . . . . 46 46 47 48 48 49 51 52 53 55 56 56 57 58 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 60 61 62 63 64 65 66 67 67 68 69 70 71 72 73 73 74 75 76 77 78 79 80 81 82 82 83 84 84 85 86 87 87 89 89 90 91 92 93 Contents Microsoft DNS Server - Domain name exceeding maximum packet length (dns_maxlen_pkt) . . . . . . Microsoft DNS Server - Name offset exceeding DNS message packet length (dns_name_offset) . . . BIND 8.2 and 8.2.1 remote buffer overflow in the processing of NXT records (DNS_NXT_Overflow) BIND 8.2.x transaction signature (TSIG) buffer overflow (DNS_TSIG_Overflow) . . . . . . . . . . . . . . . . Zone transfer request for non-existent or non-authoritative zone (dns_unauth_xfer) . . . . . . . . . . . . Microsoft DNS Server - DNS Zone Transfers from high ports (DNS_Zone_High_Port). . . . . . . . . . . Microsoft DNS Server - DNS honors zone transfer requests (DNS_Zone_Transfer) . . . . . . . . . . . . Doly backdoor for Windows (Doly) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Donald Dick backdoor for Windows (DonaldDick) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Desktop Protection System Server reported a critical event (DPS_Server_Critical_Event). . . . . . . . . Stack overflow error reported by Dr. Watson diagnostic tool (drw_stack_ovflw) . . . . . . . . . . . . . . . Echo service (Echo_Denial_of_Service). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ALMail POP3 overflow in SMTP processing code (Email_Almail_Overflow) . . . . . . . . . . . . . . . . . . . AMaViS virus scanner allows arbitrary command execution as root (Email_Amavis_Exec) . . . . . . . . SMTP in debug mode (Email_Debug) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sendmail decode/uudecode alias could allow remote file creation (Email_Decode) . . . . . . . . . . . . . SMTP daemon supports EHLO (Email_Ehlo) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange Server Information Store (store.exe) denial of service (Email_ExchangeStore_DoS) . . . . . . SMTP EXPN command (Email_Expn) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SMTP EXPN buffer overflow can crash or obtain access (Email_Expn_Overflow) . . . . . . . . . . . . . . . Email From (Email_From) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SMTP HELO buffer overflow can crash or obtain access (Email_Helo_Overflow) . . . . . . . . . . . . . . . Listserv buffer overflow allows execution of arbitrary code (Email_Listserv_Overflow). . . . . . . . . . . . Microsoft Outlook date header buffer overflow (Email_Outlook_Date_Overflow) . . . . . . . . . . . . . . . . Sendmail pipe attack (Email_Pipe). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Qmail long SMTP command denial of service (Email_Qmail_Length) . . . . . . . . . . . . . . . . . . . . . . . Qmail email RCPT denial of service (Email_Qmail_Rcpt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Third-party mail relaying can be used to obfuscate the origin of emails (Email_Relay_Spam) . . . . . . . Email subject (Email_Subject) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Email to (Email_To). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Avirt mail server allows remote users to create directories (Email_To_Dot_Dot) . . . . . . . . . . . . . . SMTP TURN command reverses connections (Email_Turn) . . . . . . . . . . . . . . . . . . . . . . . . . . . . SMTP verify (VRFY) command can be used to validate users (Email_Vrfy) . . . . . . . . . . . . . . . . . . . SMTP VRFY buffer overflow can crash or obtain access (Email_Vrfy_Overflow) . . . . . . . . . . . . . . . Sendmail wizard (WIZ) backdoor allows anonymous remote root access (Email_WIZ) . . . . . . . . . . . Microsoft Exchange Server SMTP and NNTP denial of service (Email_Xchg_Auth) . . . . . . . . . . . . . RealSecure event collector error message (EventCollector_Error) . . . . . . . . . . . . . . . . . . . . . . . . RealSecure Event Collector information message (EventCollector_Info) . . . . . . . . . . . . . . . . . . . . . RealSecure event collector warning message (EventCollector_Warning) . . . . . . . . . . . . . . . . . . . . Event Horizon backdoor for Windows (EventHorizon) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . EvilFTP backdoor FTP server for Windows (EvilFTP_Backdoor). . . . . . . . . . . . . . . . . . . . . . . . . . . Windows event log file corrupted (evt_logcorrupt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows event log full (evt_logfull) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows event log file cannot be opened (evt_openfail) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange administrative user connected (Exchange55_administrator_connect) . . . . . . . . . . . . . . . Exchange Administrator logged in (Exchange55_administrator_login_as_user) . . . . . . . . . . . . . . . . Exchange POP3 server dropped connection (Exchange55_pop3_authentication_failures) . . . . . . . . . Exchange POP3 server unauthenticated command (Exchange55_unauthenticated_pop3_command) . Exchange POP3 server invalid unauthenticated command (Exchange55_unauthenticated_pop3_command_invalid) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange POP3 server invalid unauthenticated arguments (Exchange55_unauthenticated_pop3_command_invalidargs) . . . . . . . . . . . . . . . . . . . . . . . . . Exchange POP3 server incorrect number of unauthenticated arguments (Exchange55_unauthenticated_pop3_command_wrongargs) . . . . . . . . . . . . . . . . . . . . . . . . . Exchange View Administrative user logged in (Exchange55_view_administrator_login) . . . . . . . . . . . Exchange administrative user connected (Exchange_administrator_connect) . . . . . . . . . . . . . . . . . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. . 95 . 95 . 96 . 98 102 103 103 104 105 106 107 108 109 110 111 112 113 114 115 117 118 118 120 121 122 123 124 125 126 126 127 128 128 130 132 133 134 135 136 136 137 138 139 141 141 142 143 143 . . 144 . . 145 . . 146 . . 146 . . 147 ix Contents Exchange Administrator logged in (Exchange_administrator_login_as_user) . . . . . . . . . . . . . . . . . . . . Exchange anonymous logon (Exchange_anonymous_logon) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange IMAP server dropped connection (Exchange_imap_authentication_failures) . . . . . . . . . . . . . Exchange mailbox logon failed (Exchange_logon_failure) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange mail sent as another user (Exchange_mail_sent_as) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange mail sent on behalf of another user (Exchange_mail_sent_on_behalf) . . . . . . . . . . . . . . . . . Exchange NNTP server dropped connection (Exchange_nntp_authentication_failures) . . . . . . . . . . . . . Exchange POP3 server dropped connection (Exchange_pop3_authentication_failures) . . . . . . . . . . . . . Exchange personal storage file password saved (Exchange_PST_passwords_saved) . . . . . . . . . . . . . . Exchange security attributes changed (Exchange_security_attribute_change) . . . . . . . . . . . . . . . . . . . Exchange service account password change (Exchange_service_password_change) . . . . . . . . . . . . . . Exchange IMAP server unauthenticated command (Exchange_unauthenticated_imap_command) . . . . . Exchange unauthenticated logon attempt (Exchange_unauthenticated_logon_attempt) . . . . . . . . . . . . Exchange NNTP server unauthenticated command (Exchange_unauthenticated_nntp_command) . . . . . Exchange POP3 server unauthenticated command (Exchange_unauthenticated_pop3_command) . . . . . Exchange POP3 server invalid unauthenticated command (Exchange_unauthenticated_pop3_command_invalid) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange POP3 server invalid unauthenticated arguments (Exchange_unauthenticated_pop3_command_invalidargs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange POP3 server incorrect number of unauthenticated arguments (Exchange_unauthenticated_pop3_command_wrongargs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange mailbox accessed by other user (Exchange_user_login_into_other_users_mailbox) . . . . . . . . Exchange View Administrative user logged in (Exchange_view_administrator_login) . . . . . . . . . . . . . . . System file or executable modification attempt failed (Failed_change_of_important_files) . . . . . . . . . . . Failed login attempt to a disabled user account (Failed_login-account_disabled) . . . . . . . . . . . . . . . . . Failed login attempt to an expired user account (Failed_login-account_expired). . . . . . . . . . . . . . . . . . Failed login attempt to a locked user account (Failed_login-account_locked_out) . . . . . . . . . . . . . . . . . Windows NT user account locked out (Failed_login-account_locked_out_New) . . . . . . . . . . . . . . . . . . Failed login attempt with invalid username or password (Failed_login-bad_username_or_password). . . . Failed login attempt when net logon is not active (Failed_login-net_logon_not_active) . . . . . . . . . . . . . . Login attempt by user not authorized for console login (Failed_login-not_authorized_for_console_login) . Failed login attempt by user without the right to access the computer from the network (Failed_loginnot_authorized_for_this_type_of_login) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Failed login with an expired password (Failed_login-password_expired) . . . . . . . . . . . . . . . . . . . . . . . Failed login attempt during restricted access hours (Failed_login-time_restriction_violation) . . . . . . . . . Login attempt failed for an unknown reason (Failed_login-unknown_error) . . . . . . . . . . . . . . . . . . . . . Finger bomb recursive request (Finger_Bomb) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Finger perl attempt (Finger_Perl) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Finger buffer overflow allows root access (Finger_RTM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Finger user (Finger_User) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Forced Entry backdoor for Windows (ForcedEntry) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Fore backdoor for Windows 95/98 (Fore) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Freak88 allows a remote attacker to coordinate small-scale DDoS attacks (Freak88) . . . . . . . . . . . . Frenzy backdoor for Windows 95/98 (Frenzy) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . FSP daemon running (FSP_Detected) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . FTGate Web interface allows remote attackers to read files from the system (HTTP_DotDot) . . . . . . . AIX ftpd daemon buffer overflow (FTP_AIX_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ftpd args core dump (FTP_Args) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . FTP bounce attack could allow attackers to 'proxy' connections (FTP_Bounce) . . . . . . . . . . . . . . . . . . FTP server command contains format string (FTP_Format_String) . . . . . . . . . . . . . . . . . . . . . . . . . FTP get file (FTP_Get) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Multiple FTP servers glob(3) expansion buffer overflow (FTP_Glob_Expansion) . . . . . . . . . . . . . . . . . . Multiple FTP servers glob(3) implementation buffer overflow (FTP_Glob_Implementation) . . . . . . . . . . . FTP mkdir (FTP_Mkdir) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . NetTerm ftp 'dele' command buffer overflow (FTP_NetTerm_Dele_Overflow) . . . . . . . . . . . . . . . . . . . NetTerm ftp 'dir' command buffer overflow (FTP_NetTerm_Dir_Overflow) . . . . . . . . . . . . . . . . . . . . . x 148 148 149 149 150 151 151 152 153 153 154 155 155 156 157 158 158 159 160 161 162 162 163 164 165 165 166 167 168 169 169 170 171 172 173 173 174 175 176 176 177 179 179 180 181 182 183 184 186 188 188 189 Contents NetTerm ftp 'ls' command buffer overflow (FTP_NetTerm_Ls_Overflow) . . . . . . . . . . . . . . . . . . . . . . 190 NetTerm ftp 'mkd' command buffer overflow (FTP_NetTerm_Mkd_Overflow) . . . . . . . . . . . . . . . . . . . 190 NetTerm ftp 'pass' command buffer overflow (FTP_NetTerm_Pass_Overflow) . . . . . . . . . . . . . . . . . . 191 NetTerm ftp 'rmdir' command buffer overflow (FTP_NetTerm_Rmdir_Overflow) . . . . . . . . . . . . . . . . . 192 FTP password (FTP_Pass) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 Privileged port attack enabled on FTP server (FTP_PrivilegedBounce) . . . . . . . . . . . . . . . . . . . . . . . . 193 FTP privileged port bounce can conceal attacker's identity (FTP_PrivilegedPort) . . . . . . . . . . . . . . . . . 195 FTP put file (FTP_Put) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 FTP CWD ~root login (FTP_Root) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 FTP root login success detected (FTP_root_login) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 FTP site command (FTP_Site_Cmd) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 FTP SITE EXEC can allow arbitrary command execution (FTP_Site_Exec_DotDot) . . . . . . . . . . . . . . . . 199 FTP Site Exec Tar allows remote access (FTP_Site_Exec_Tar) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 FTP SYST command (FTP_Syst) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 FTP username (FTP_User) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 FTP user login success detected (FTP_user_login) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 FireWall-1 misconfiguration could allow attackers to manipulate filter modules (FW1_Auth_As_Local) . . 203 FireWall-1 FWA1 authentication weakness (FW1_Auth_Replay) . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 FireWall-1 allows remote "get topology" requests without authentication (FW1_GetTopology). . . . . . . . 206 GateCrasher backdoor for Windows (GateCrasher) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 Gauntlet Firewall CyberPatrol integration buffer overflow (Gauntlet_CyberDaemon_Overflow) . . . . . . . . 208 Gauntlet ICMP packet denial of service (Gauntlet_ICMP_DoS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209 GayOL backdoor for Windows and AOL (GayOL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 Buffer overflows can lead to arbitrary command execution (Generic_Intel_Overflow) . . . . . . . . . . . . . . 211 GirlFriend backdoor for Windows (GirlFriend) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 Glacier backdoor for Windows (Glacier) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Global group access or privileges modified (Global_group_changed) . . . . . . . . . . . . . . . . . . . . . . . . . 214 Global group created on the domain (Global_group_created). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Global group deleted from the domain (Global_group_deleted). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Global group membership modified - user added (Global_group_user_added) . . . . . . . . . . . . . . . . . . . 216 Global group membership modified - user removed (Global_group_user_removed) . . . . . . . . . . . . . . . 217 Gnutella Connection (Gnutella_Connect) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 Gnutella Download (Gnutella_Download) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 Gnutella Worm (Gnutella_Worm) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 Windows 2000 group type change (Group_type_changed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 Logon event by a Guest user (Guest_user_login) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 Hack'a'Tack backdoor for Windows (HackATack). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 Hacker's Paradise backdoor for Windows 95/98 and NT (HackersParadise) . . . . . . . . . . . . . . . . . . 222 Host Control backdoor for Windows (HostControl) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 HP OpenView hidden SNMP community (HP_OpenView_SNMP_Backdoor) . . . . . . . . . . . . . . . . . . . . 225 HP-UX rlpd print protocol daemon buffer overflow (HPUX_RLPD_Overflow) . . . . . . . . . . . . . . . . . . . . 226 Alibaba Web server allows browsing the file system outside the server root directory (HTTP_DotDot) . . 228 Glimpse HTTP aglimpse allows remote command execution (HTTP_Glimpse) . . . . . . . . . . . . . . . . . . . 228 IIS 3.0 script source revealed by appending 2E to requests (HTTP_IIS3_Asp_Dot) . . . . . . . . . . . . . . . 230 IIS ASP source visible (HTTP_IIS3_Asp_Dot) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 Sybase PowerDynamo PWS allows remote file system traversal (HTTP_DotDot) . . . . . . . . . . . . . . . . 232 TeamTrack HTTP server allows browsing the file system outside the server root directory (HTTP_DotDot). . 233 3Com AirConnect Easy Setup Web Access (HTTP_3com_AirConnect_EasySetup) . . . . . . . . . . . . . . . 233 3Com AirConnect Filtering Setup Web Access (HTTP_3com_AirConnect_FilteringSetup). . . . . . . . . . . 234 3Com AirConnect Firmware Web Access (HTTP_3com_AirConnect_FirmwareSetup) . . . . . . . . . . . . . 235 3Com AirConnect Modem Setup Web Access (HTTP_3com_AirConnect_ModemSetup) . . . . . . . . . . . 236 3Com AirConnect RF Setup Web Access (HTTP_3com_AirConnect_RFSetup) . . . . . . . . . . . . . . . . . . 236 3Com AirConnect Security Setup Web Access (HTTP_3com_AirConnect_SecuritySetup) . . . . . . . . . . 237 3Com AirConnect SNMP Setup Web Access (HTTP_3com_AirConnect_SNMPSetup). . . . . . . . . . . . . 238 xi Contents 3Com AirConnect Special Functions Web Access (HTTP_3com_AirConnect_SpecialFunctions). . . . . . . 239 3Com AirConnect System Setup Web Access (HTTP_3com_AirConnect_SystemSetup) . . . . . . . . . . . 239 ActiveX allows local command execution (HTTP_ActiveX) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240 HTTP Anyform (HTTP_AnyForm). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 AnyForm CGI script allows remote execution of arbitrary commands (HTTP_AnyFormPost) . . . . . . . . . 242 Apache HTTP server beck exploit (HTTP_Apache_DOS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 HTTP authentication (HTTP_Authentication) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244 Axis StorPoint CD servers could allow remote access to admin pages (HTTP_Axis_Storpoint) . . . . . . . 244 Win32 CGI programs written as DOS batch files could allow remote command execution (HTTP_BAT_Execute) 245 Brown Orifice HTTPD (HTTP_BrownOrifice) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 Squid cachemgr.cgi script can be used to remotely proxy portscans (HTTP_Cachemgr) . . . . . . . . . . . 248 Campas cgi-bin file executes remote commands (HTTP_Campas) . . . . . . . . . . . . . . . . . . . . . . . . . . 249 iCat Carbo Server allows remote file viewing (HTTP_Carbo_Server) . . . . . . . . . . . . . . . . . . . . . . . . . 250 Carello Web shopping cart add.exe allows remote file creation and duplication (HTTP_Carello) . . . . . . 251 Cart32 shopping cart allows remote attackers to change admin password (HTTP_Cart32_ChangeAdminPassword) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 Cart32 shopping cart allows remote access to client lists and admin functions (HTTP_Cart32_ClientList) . . 253 Cart32 shopping cart allows remote access to server installation details (HTTP_Cart32_Expdate) . . . . 254 Cdomain whois_raw.cgi script allows remote execution of arbitrary commands (HTTP_Cdomain) . . . . . 254 Cisco Aironet Web Configuration in use (HTTP_Cisco_Aironet_Webconfig) . . . . . . . . . . . . . . . . . . . . 255 Cisco Catalyst allows anonymous user to execute commands (HTTP_Cisco_Catalyst_Exec) . . . . . . . . . 256 Cisco IOS routers denial of service caused by HTTP commands (HTTP_Cisco_IOS_DoS) . . . . . . . . . . . 257 Cisco IOS query denial of service (HTTP_Cisco_IOS_Query_DoS). . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 Classifieds.cgi script allows a remote attacker to read arbitrary files off servers (HTTP_Classifieds_Post) . . 259 ColdFusion Expression Evaluator allows remote file manipulation (HTTP_Cold_Fusion) . . . . . . . . . . . . . 260 ColdFusion Web administration feature can be used to stop the CF server (HTTP_ColdFusion_Admin). . 261 ColdFusion CFCACHE tag could expose temporary files with sensitive information (HTTP_ColdFusion_Cfcache) 262 ColdFusion email example script can be used to view arbitrary files (HTTP_ColdFusion_Email_ExampleApp) . 263 ColdFusion sample program can be used to confirm existence of arbitrary files (HTTP_ColdFusion_FileExists) 264 ColdFusion sample program can allow remote users to read any file (HTTP_ColdFusion_SourceWindow) 265 ColdFusion syntax checker could consume all processor resources (HTTP_ColdFusion_SyntaxChecker_DOS) 266 ColdFusion sample can reveal source to any CFM file (HTTP_ColdFusion_ViewExample) . . . . . . . . . . . . 266 ColdFusion Web publish example script can be used to upload and execute files (HTTP_ColdFusion_WebPublish_ExampleApp) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 Cookies passed to Web browser (HTTP_Cookie) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 Count.cgi allows remote users to view arbitrary GIF files (HTTP_Count) . . . . . . . . . . . . . . . . . . . . . . 269 Dansie shopping cart backdoor allows attacker to execute arbitrary commands (HTTP_Dansie_Backdoor). . 270 Dansie Shopping Cart contains hidden email routine (HTTP_Dansie_Cart) . . . . . . . . . . . . . . . . . . . . . 271 Dansie shopping cart allows retrieval of sensitive configuration information (HTTP_Dansie_Infoleak) . . . 272 HTTP "dot dot" sequences (HTTP_DotDot) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 Dragon Fire IDS allows remote command execution through dfire.cgi script (HTTP_DragonFire). . . . . . 274 ECWare IIS CGI program denial of service (HTTP_ECware_DoS) . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 EZMall 2000 shopping cart misconfiguration exposes the order log (HTTP_EZMall2000) . . . . . . . . . . 276 EZshopper loadpage.cgi could be used to execute arbitrary commands (HTTP_EZShopper_Loadpage) . 276 EZshopper search.cgi could be used to execute arbitrary commands (HTTP_EZShopper_Search). . . . . 277 HylaFax faxsurvey CGI allows execution of commands (HTTP_FaxSurvey) . . . . . . . . . . . . . . . . . . . . . . 278 FormMail CGI program multiple vulnerabilities (HTTP_FormMail) . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 FrontPage Server Extensions device name denial of service (HTTP_FrontPage_DeviceName) . . . . . . . . 280 xii Contents FrontPage Server Extensions Visual Studio RAD Support sub-component buffer overflow (HTTP_Frontpage_Extensions_RAD_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 HTTP get (HTTP_Get) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 Glimpse Web server allows remote command execution (HTTP_Glimpse) . . . . . . . . . . . . . . . . . . . . . 283 Guestbook could allow execution of commands from remote (HTTP_Guestbook) . . . . . . . . . . . . . . . . 284 HTTP HEAD request detected (HTTP_Head). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285 Home Free CGI search.cgi script allows remote directory listings (HTTP_HomeFree_Search). . . . . . . . 286 Htmlscript CGI allows remote file reading (HTTP_HTMLScript) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 Internet Explorer 3.0 allows remote command execution (HTTP_IE3_URL) . . . . . . . . . . . . . . . . . . . . 287 Win32 Web servers remote command execution through .CMD and .BAT files (HTTP_IE_BAT) . . . . . . 288 IIS ASP DATA issue could reveal source code (HTTP_IIS$DATA) . . . . . . . . . . . . . . . . . . . . . . . . . . . 289 IIS ASP dot bug (HTTP_IIS3_Asp_Dot) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290 IIS 4.0/5.0 escaped percent found (HTTP_IIS_Double_Eval_Evasion) . . . . . . . . . . . . . . . . . . . . . . . . 291 IIS 4.0/5.0 malformed hex sequence (HTTP_IIS_Hex_Evasion) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292 IIS idq.dll ISAPI extension buffer overflow (HTTP_IIS_Index_Server_Overflow). . . . . . . . . . . . . . . . . . . . 292 IIS 5.0 ISAPI Internet Printing Protocol extension buffer overflow (HTTP_IIS_ISAPI_Printer_Overflow) . . . 295 IIS allows remote attackers to obtain source code fragments using +.htr (HTTP_IIS_Obtain_Code) . . . . 297 IIS 4.0/5.0 malformed double percent sequence (HTTP_IIS_Percent_Evasion) . . . . . . . . . . . . . . . . . 299 IIS and SiteServer Showcode.asp sample file allows remote file viewing (HTTP_IIS_Showcode) . . . . . . . 299 IIS %u Unicode encoding detected (HTTP_IIS_Unicode_Encoding) . . . . . . . . . . . . . . . . . . . . . . . . . . . 300 IIS Unicode translation error allows remote command execution (HTTP_IIS_Unicode_Translation) . . . . . 301 IIS %u Unicode wide character encoding detected (HTTP_IIS_Unicode_Wide_Encoding) . . . . . . . . . . . . 303 IIS URL decoding error could allow remote code execution (HTTP_IIS_URL_Decoding) . . . . . . . . . . . . . 305 UTF8 found in the HTTP data (HTTP_IIS_UTF8_Evasion) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 IIS ExAir sample site denial of service (HTTP_IISExAir_DoS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 IIS buffer overflow in HTR requests can allow remote code execution (HTTP_IISHTR_Overflow) . . . . . . . 308 Microsoft Index Server idq.dll allows remote directory traversal (HTTP_IndexServer_IDQ) . . . . . . . . . . 310 Microsoft Index Server webhits.dll allows remote directory traversal (HTTP_IndexServer_Webhits) . . . . 311 info2www script allows remote execution of commands (HTTP_Info2WWW) . . . . . . . . . . . . . . . . . . 312 HTTP Java (HTTP_Java) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 jj CGI program could allow remote command execution (HTTP_JJ) . . . . . . . . . . . . . . . . . . . . . . . . . 314 WebLogic allows users to read source of JSP files (HTTP_JSP_SourceRead) . . . . . . . . . . . . . . . . . . 314 MachineInfo script reveals system information (HTTP_MachineInfo) . . . . . . . . . . . . . . . . . . . . . . . . . 315 IIS unauthorized ODBC data access with RDS (HTTP_MDAC_Access). . . . . . . . . . . . . . . . . . . . . . . . 316 Internet Explorer msradio buffer overflow (HTTP_MSRadio_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . 319 NCSA httpd allows remote users to execute commands (HTTP_NCSA_Buffer_Overflow) . . . . . . . . . . . 320 Netscape Enterprise Server allows remote directory listing (HTTP_Netscape_List_Directories). . . . . . . 321 Netscape Enterprise Server can be tricked into listing Web directories (HTTP_Netscape_PageServices) 322 Netscape Enterprise Server REVLOG denial of service (HTTP_Netscape_Revlog) . . . . . . . . . . . . . . . . 322 Netscape servers could reveal source code to some scripts (HTTP_Netscape_SpaceView) . . . . . . . . . 323 Nimda worm propagation (HTTP_Nimda_Riched20dll) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324 Novell Convert.bas Web server script (HTTP_Novell_Convert) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326 Novell CGI script files.pl could allow remote file viewing (HTTP_Novell_Files). . . . . . . . . . . . . . . . . . . . 327 Nph-test-cgi program remote users can list files (HTTP_NphTestCgi) . . . . . . . . . . . . . . . . . . . . . . . . 328 Netscape Enterprise and Fasttrack authentication buffer overflow (HTTP_NS_Admin_Overflow) . . . . . . 329 Win32 Web servers allow access to files requested using the 8.3 format (HTTP_NT8.3_Filename) . . . 330 Oracle Application Server shared library (ndwfn4.so) buffer overflow (HTTP_Oracle_Appserver_Overflow) 332 Order Form shopping cart misconfiguration exposes order information (HTTP_Orderform) . . . . . . . . . 333 PDGSoft’s Shopping Cart misconfiguration exposes config and order files (HTTP_PDGSoft) . . . . . . . . . 334 IRIX pfdispaly.cgi program was not fixed by a previous SGI patch (HTTP_Pfdisplay_Execute) . . . . . . . . . 335 SGI pfdispaly.cgi script allows remote file viewing with server privileges (HTTP_Pfdisplay_Read) . . . . . . 335 Phone book CGI phf allows remote execution of arbitrary commands (HTTP_PHF) . . . . . . . . . . . . . . . 336 PHP/FI php.cgi script contains a remotely exploitable buffer overflow (HTTP_PHP_Overflow) . . . . . . . . 337 PHP remote users can read files (HTTP_PHP_Read) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338 PHP-Nuke unauthorized administrator access (HTTP_PHPNuke_Admin_Access) . . . . . . . . . . . . . . . . 339 xiii Contents PHP-Nuke could allow attackers to redirect ad banner URL links (HTTP_PHPNuke_URL_Redirect) . . . . 340 HTTP POST request to a script or resource (HTTP_Post) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341 QuikStore Shopping Cart misconfiguration exposes the config file (HTTP_QuikStore) . . . . . . . . . . . . . . 342 IRIX reg_echo.cgi reveals server hardware information (HTTP_RegEcho) . . . . . . . . . . . . . . . . . . . . . 343 Robots.txt file controls Web spiders (HTTP_RobotsTxt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343 Nlog CGI script executes commands (HTTP_RpcNLog) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344 SCO view-source CGI script allows remote users to read files (HTTP_SCO_View-Source) . . . . . . . . . . . 344 Malformed HTML <SCRIPT> tag could bypass firewall active content stripping (HTTP_Script_Bypass) . . 345 IRIX handler CGI allows remote command execution (HTTP_SGI_Handler) . . . . . . . . . . . . . . . . . . . . . 346 IRIX infosrch.cgi fname variable allows remote attackers to execute commands (HTTP_SGI_Infosrch) . . 347 SGI Webdist CGI script allows remote command execution (HTTP_SGI_Webdist) . . . . . . . . . . . . . . . . 348 SGI IRIX cgi-bin wrap program remote users can list files (HTTP_SGI_Wrap) . . . . . . . . . . . . . . . . . . . 349 Cobalt RaQ Web server could reveal user's command history (HTTP_ShellHistory) . . . . . . . . . . . . . . . 350 Shell interpreters can be used to execute commands on Web servers (HTTP_Shells). . . . . . . . . . . . . 351 Shockwave plugin allows reading of users' email (HTTP_ShockWave) . . . . . . . . . . . . . . . . . . . . . . . . 352 SiteServer 3.0 AdSamples installation could expose SQL server login information (HTTP_SiteCsc_Access). . 353 SoftCart misconfiguration exposes passwords or order information (HTTP_Softcart) . . . . . . . . . . . . . 354 Test-cgi sample CGI script allows remote retrieval of file listings (HTTP_TestCgi) . . . . . . . . . . . . . . . . 354 Suspicious URL with tilde (~) appended (HTTP_Tilde) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355 passwd file accessed through Web server (HTTP_Unix_Passwords). . . . . . . . . . . . . . . . . . . . . . . . . 356 Verity search97 CGI script allows remote file reading (HTTP_Verity_Search) . . . . . . . . . . . . . . . . . . . 357 HTTP connections from vulnerable clients (HTTP_Vulnerable_Client). . . . . . . . . . . . . . . . . . . . . . . . . 358 Weakness CGI Scanner (HTTP_WeaknessCGIScanner) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359 Web finger access attempt (HTTP_WebFinger) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360 WEBgais CGI script allows remote command execution (HTTP_Webgais) . . . . . . . . . . . . . . . . . . . . . 360 WebLogic FileServlet show code (HTTP_WebLogic_FileServlet_Show_Code) . . . . . . . . . . . . . . . . . . . 361 WebLogic allows users to read source of files (HTTP_WebLogic_FileSourceRead) . . . . . . . . . . . . . . . 362 BEA Systems WebLogic Java injection (HTTP_WebLogic_JavaInjection) . . . . . . . . . . . . . . . . . . . . . . 363 WebLogic redirect request plugin buffer overflow can be used to gain root (HTTP_WebLogic_PluginBO) 364 WebGais websendmail allows remote command execution (HTTP_Websendmail) . . . . . . . . . . . . . . . 365 WebSite 1.1 for Windows NT winsample buffer overflow (HTTP_WebSite_Sample) . . . . . . . . . . . . . . 365 WebSite 1.1 uploader (HTTP_WebSite_Uploader). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366 WebSphere Application Server Host: header denial of service (HTTP_WebSphere_HeaderDoS) . . . . . . 367 Selena Sol’s WebStore could expose order information (HTTP_WebStore) . . . . . . . . . . . . . . . . . . . . 368 WindMail remote file retrieval (HTTP_WindMail_FileRead) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369 Executable command in HTTP path (HTTP_Windows_Executable) . . . . . . . . . . . . . . . . . . . . . . . . . . 370 WWWThreads SQL commands could allow users to gain privileges (HTTP_WWWThreads_Admin) . . . 370 HVL-RAT backdoor for Windows and AOL (Hvl_Rat). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371 Ident errors may indicate probe of Ident service (Ident_Error) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 Linux identd configuration remote denial of service (Ident_Linux_DoS). . . . . . . . . . . . . . . . . . . . . . . . 374 Ident newline allows remote users to execute commands (Ident_Newline). . . . . . . . . . . . . . . . . . . . . 375 Ident buffer overflow allows remote users to execute commands (Ident_Overflow) . . . . . . . . . . . . . . . 376 Ident user (Ident_User) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377 Internet Explorer allows active content to be automatically downloaded (HTTP_ActiveX) . . . . . . . . . . . 378 Internet Explorer is outdated (HTTP_Vulnerable_Client) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 Attempt to read or modify an 802.11 device's SSID (SNMP_Suspicious_Set) . . . . . . . . . . . . . . . . . . 379 Attempt to read or modify an 802.11 device's WEP encryption key (SNMP_Suspicious_Set) . . . . . . . . 380 IMail buffer overflow in built-in LDAP server (Imail_ldap_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . 381 IMAP2bis server, anonymous login successful (IMAP2bis_server_anonymous_login_successful) . . . . . . 382 IMAP2bis Server, brute force attack (IMAP2bis_server_brute_force_attack) . . . . . . . . . . . . . . . . . . . 383 IMAP2bis Server, pre-authenticated user login successful (IMAP2bis_server_preauthenticated_user_login_successful) . . . . . . . . . . . . . . . . . . . . . . . . . . . 384 IMAP2bis Server, user Auto-logout (IMAP2bis_server_user_auto-logout) . . . . . . . . . . . . . . . . . . . . . 384 IMAP2bis Server, user login failure (IMAP2bis_server_user_login_failure) . . . . . . . . . . . . . . . . . . . . . 385 xiv Contents IMAP2bis Server, user login successful (IMAP2bis_server_user_login_successful) . . . . . . . . . . . . . . . 386 IMAP2bis Server, user logout (IMAP2bis_server_user_logout) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386 IMAP AUTHENTICATE overflow could allow remote root access (IMAP_Authenticate_Overflow) . . . . . . 387 IMail IMAP service buffer overflow (IMAP_Imail_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388 Microsoft Outlook date header buffer overflow (IMAP_Outlook_Date_Overflow) . . . . . . . . . . . . . . . . . . 389 IMAP login buffer overflow could allow remote root access (IMAP_Overflow) . . . . . . . . . . . . . . . . . . . 391 IMAP password (IMAP_Password) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392 IMAP username (IMAP_User) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393 Infector backdoor for Windows (Infector). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393 INN control message allows commands to be executed as root (INN_Control) . . . . . . . . . . . . . . . . . 395 INN buffer overflow attack allows users to execute arbitrary code (INN_Overflow) . . . . . . . . . . . . . . . 396 INN verifycancels option allows remote code execution (Innd_Cancel_Overflow) . . . . . . . . . . . . . . . . . 397 NetBSD unaligned IP options (IP_Unaligned_Timestamp) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398 Duplicate IP addresses (IPDuplicate) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399 IP fragmentation (IPFrag) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 TCP Half scan (Stealth scan) (IPHalfScan) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401 IPOP3D, brute force attack (IPOP3D_brute_force_attack). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402 IPOP3D, Buffer overflow attack (IPOP3D_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403 IPOP3D, user auto-logout (IPOP3D_user_auto-logout) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403 IPOP3D, user kiss of death logout (IPOP3D_user_kiss_of_death_logout) . . . . . . . . . . . . . . . . . . . . . . 404 IPOP3D, user login failure (IPOP3D_user_login_failure). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405 IPOP3D, user login successful (IPOP3D_user_login_successful) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405 IPOP3D user login to remote host successful (IPOP3D_user_login_to_remote_host_successful) . . . . . . 406 IPOP3D, user logout (IPOP3D_user_logout) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407 TCP/IP protocol violations (IPProtocolViolation) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407 Unknown IP protocol (IPUnknownProtocol) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408 IRC buffer overflow allows attackers to execute commands as root (IRC_Daemon_Overflow) . . . . . . . . 409 IRC channel joined (IRC_Join) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409 IRC message (IRC_Msg) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410 IRC nick (IRC_Nick). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411 Trinity distributed denial of service tool (IRC_Trinity). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411 IRDP can be used to change the default gateway of some systems (IRDP_Gateway_Spoof) . . . . . . . . . 412 Internet Scanner or Desktop Protection System detected a high risk vulnerability (IS_High_Vulnerability_Found) 413 Internet Scanner detected a low risk vulnerability (IS_Low_Vulnerability_Found) . . . . . . . . . . . . . . . . . 414 Internet Scanner detected a medium risk vulnerability (IS_Meduim_Vulnerability_Found) . . . . . . . . . . . 415 Internet Scanner scan completed (IS_Scan_Completed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415 Internet Scanner scan started (IS_Scan_Started) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416 ISA Server component failed (ISA_Abnormal_Termination) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416 ISA Alert service failed to log an event (ISA_Alert_Failed_Log) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417 ISA Server failed to start (ISA_Failed_To_Start) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417 ISA Firewall service initialization failed (ISA_FW_Init_Failed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418 ISA Firewall service failed to start (ISA_FW_Start_Failed_Corrupt) . . . . . . . . . . . . . . . . . . . . . . . . . . 418 ISA Firewall service stopped (ISA_FW_Stop) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419 ISA Server failed to write an event to the log (ISA_LOG_File_Write_Failed) . . . . . . . . . . . . . . . . . . . . . 420 ISA Server stopped logging events (ISA_LOG_Service_Stopped_Logging_Failure) . . . . . . . . . . . . . . . . . 420 ISA Server failed to create a packet filter (ISA_PF_Create_PF_Failure) . . . . . . . . . . . . . . . . . . . . . . . 421 ISA Server packet filter rebind failure (ISA_PF_Dial_Out_Rebind_Failure) . . . . . . . . . . . . . . . . . . . . . . 421 ISA Server packet filter is dropping packets (ISA_PF_Dropping_Packets) . . . . . . . . . . . . . . . . . . . . . . 422 ISA Server packet filters disabled (ISA_PF_Filtering_Disabled) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422 ISA Server packet filter insecure configuration (ISA_PF_Insecure_Config) . . . . . . . . . . . . . . . . . . . . . 423 ISA Server packet filter interface bind failure (ISA_PF_Interface_Bind_Failure) . . . . . . . . . . . . . . . . . . 424 ISA Server failed to create an IP packet filter (ISA_PF_IP_PF_Create_Failure) . . . . . . . . . . . . . . . . . . . 424 ISA Server packet filter did not detect an external interface (ISA_PF_No_Ext_Interface) . . . . . . . . . . . . 425 ISA Server packet filter protocol violation detected (ISA_PF_Protocol_Violation) . . . . . . . . . . . . . . . . . 425 xv Contents ISA Server Control service initialization failed (ISA_SCS_Init_Failed) . . . . . . . . . . . . . . . . . . . . . . . . . . 426 ISA Server Control service stopped (ISA_SCS_Stop). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426 ISA Server corrupted registry (ISA_Server_Init_Failed_Corrupt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427 ISA Server insecure configuration (ISA_Server_NAT_Insecure) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428 ISA Web Proxy service stopped (ISA_WPS_Stop) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428 ISA Web Proxy service failed (ISA_WPS_Terminated) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429 Internet Scanner vulnerability assessment (ISS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429 IP fragment reassembly denial of service (Jolt2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430 Kerberos IV peek accesses usernames and information (Kerberos_User_Snarf) . . . . . . . . . . . . . . . . 431 Kuang2 Virus installs remote control functionality on infected systems (Kuang2Virus) . . . . . . . . . . . . 432 Land denial of service (Land) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433 Windows NT snork attack can disable system (Land_UDP). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436 Microsoft LDAP server blacklist failed (LDAP_blacklist_failed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 437 Microsoft LDAP server permanent blacklist (LDAP_blacklist_permanent) . . . . . . . . . . . . . . . . . . . . . 437 Microsoft LDAP server temporary blacklist (LDAP_blacklist_short-term) . . . . . . . . . . . . . . . . . . . . . . 438 Local group access or privileges modified (Local_group_changed) . . . . . . . . . . . . . . . . . . . . . . . . . . 439 Local group created with assigned members and privileges (Local_group_created) . . . . . . . . . . . . . . 440 Local group deleted from the system (Local_group_deleted) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441 Local group membership modified - user added (Local_group_user_added) . . . . . . . . . . . . . . . . . . . . 441 Local group membership modified - user removed (Local_group_user_removed) . . . . . . . . . . . . . . . . 442 Windows 2000 account logon failed (Log_on_to_account_failed) . . . . . . . . . . . . . . . . . . . . . . . . . . . 443 Logon process registered (Logon_process_registered) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444 Logon event by user with administrative privileges (Logon_with_admin_privileges). . . . . . . . . . . . . . . . 444 Logon event by user with special privileges (Logon_with_special_privileges) . . . . . . . . . . . . . . . . . . . . 445 LOKI ICMP tunneling back door (Loki) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446 Lotus Notes SMTP server can be crashed with long HELO commands (Email_Helo_Overflow) . . . . . . . 447 Lotus Domino SMTP Server policy feature buffer overflow (Lotus_Domino_SMTP_Overflow) . . . . . . . . . 448 LPRng syslog() call allows user supplied format strings (LPRng_Format_String) . . . . . . . . . . . . . . . . . 449 Mail-Max server allows remote execution of code through a buffer overflow (Email_Helo_Overflow) . . . . 450 Windows 2000 user account mapped for logon (Mapped_account). . . . . . . . . . . . . . . . . . . . . . . . . 451 Map account operation failed (Mapped_account_failed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452 Master's Paradise98 backdoor for Windows (Masters_Paradise98) . . . . . . . . . . . . . . . . . . . . . . . . 452 Maverick's Matrix backdoor for Windows 95/98 (MavericksMatrix) . . . . . . . . . . . . . . . . . . . . . . . . 454 MDaemon SMTP server can be crashed with a long HELO (Email_Helo_Overflow) . . . . . . . . . . . . . . . 455 Millenium backdoor for Windows (Millenium) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 455 Mountd export (MountdExport) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456 Mountd mount request (MountdMnt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457 Microsoft SQL 6.5 Server shutdown (MSSQL65_Shutdown). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457 Microsoft SQL Server 6.5 started (MSSQL65_Startup) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458 Microsoft SQL Server 6.5 non-trusted connection successful (MSSQL65_Successful_NonTrusted_Connection). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459 Microsoft SQL Server shutdown (MSSQL7_Shutdown). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460 Microsoft SQL Server started (MSSQL7_Startup) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460 Microsoft SQL Server non-trusted connection successful (MSSQL7_Successful_Non-Trusted_Connection) . . 461 Microsoft SQL Server failed connection (MSSQL_Failed_Connection) . . . . . . . . . . . . . . . . . . . . . . . . 462 Microsoft SQL Server shutdown (MSSQL_Shutdown). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462 Microsoft SQL Server started (MSSQL_Startup) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 Microsoft SQL Server non-trusted connection successful (MSSQL_Successful_Non-Trusted_Connection) 464 Microsoft SQL Server trusted connection successful (MSSQL_Successful_Trusted_Connection) . . . . . . 464 mstream distributed denial of service tool (master detected) (Mstream_Master) . . . . . . . . . . . . . . . . 465 mstream distributed denial of service tool (zombie detected) (Mstream_Zombie) . . . . . . . . . . . . . . . . 467 Napster client update (Napster_Client_Update). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 Napster long command (Napster_Command_Long). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 Napster create account (Napster_Create_Account) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 xvi Contents Napster download (Napster_Download) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Napster user login (Napster_Login) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Napster user information submitted (Napster_Login_Info) . . . . . . . . . . . . . . . . . . . . . . . Napster chat room private message sent (Napster_Private_Msg) . . . . . . . . . . . . . . . . . . Napster chat room public message sent (Napster_Public_Msg) . . . . . . . . . . . . . . . . . . . Napster search phrase submitted (Napster_Search). . . . . . . . . . . . . . . . . . . . . . . . . . . Napster file sharing detected (Napster_Sharing). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Netscape Navigator is outdated (HTTP_Vulnerable_Client) . . . . . . . . . . . . . . . . . . . . . . . NCX backdoor for Windows (NCX_Backdoor) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nestea Linux denial of service (TearDrop) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . NetBIOS session grant (Netbios_Session_Granted) . . . . . . . . . . . . . . . . . . . . . . . . . . . . NetBIOS session reject (Netbios_Session_Rejected) . . . . . . . . . . . . . . . . . . . . . . . . . . . NetBIOS session request (Netbios_Session_Request) . . . . . . . . . . . . . . . . . . . . . . . . . . NetBus trojan horse for Windows (NetBus) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . NetBus trojan horse for Windows (NetBus_Pro). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows Network Monitor driver started (netmon_start). . . . . . . . . . . . . . . . . . . . . . . . NetSphere backdoor for Windows and ICQ (NetSphere) . . . . . . . . . . . . . . . . . . . . . . . . NetMonitor backdoor for Windows 95/98 and NT (NetSpy) . . . . . . . . . . . . . . . . . . . . . NetSpy 1.2 backdoor for Windows (NetSpy_v12) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Guessable NFS filehandles (NfsGuess). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . NFS server could allow remote users to create device files through mknod (NfsMknod) . . . NFS does not properly identify UID (NfsUid) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Rpc.nisd buffer overflow in Solaris (NIS_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nmap scanner can remotely detect an operating system (Nmap_Scan) . . . . . . . . . . . . . . NNTP group (NNTP_Group). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . NNTP password (NNTP_Password) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . NNTP username (NNTP_User) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Microsoft Exchange Server SMTP and NNTP denial of service (NNTP_XchgAuth). . . . . . . . AUE_SETAUDIT or AUE_SETAUID calls made where real UID is non-root (Nonroot_setauid) . AUE_OSETUID or AUE_SETREUID calls made where audit UID is non-root (Nonroot_setruid) Windows Network Monitor insecure password (Packet_Capturing_Tool) . . . . . . . . . . . . . . Syncstorm patch missing (SYNFlood) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows WINS exploit using SNMP (SNMP_Suspicious_Get) . . . . . . . . . . . . . . . . . . . . . Ntpd server readvar control message buffer overflow (NTP_Readvar_Overflow) . . . . . . . . . HP OpenView Network Node Manager buffer overflow (OpenView_NNM_Overflow) . . . . . . . Oracle internal connection established (Oracle_Connect_Internal) . . . . . . . . . . . . . . . . . . Oracle connection failed (Oracle_Failed_Connection) . . . . . . . . . . . . . . . . . . . . . . . . . . . Oracle object access failed (Oracle_Failed_Object_Access) . . . . . . . . . . . . . . . . . . . . . . . Oracle shutdown (Oracle_Shutdown) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Oracle startup (Oracle_Startup) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Oracle connection successful (Oracle_Successful_Connection) . . . . . . . . . . . . . . . . . . . . Oracle object access successful (Oracle_Successful_Object_Access) . . . . . . . . . . . . . . . . Malformed oshare packet denial of service (Oshare_Attack) . . . . . . . . . . . . . . . . . . . . . . Virtual memory has been consumed (Out_of_virtual_memory) . . . . . . . . . . . . . . . . . . . . . Packet capturing tool accessed remotely (Packet_Capturing_Remote) . . . . . . . . . . . . . . . Packet capturing tool detected (Packet_Capturing_Tool). . . . . . . . . . . . . . . . . . . . . . . . . Change password attempt failed (Password_change_failed) . . . . . . . . . . . . . . . . . . . . . . Change password attempt successful (Password_change_successful) . . . . . . . . . . . . . . . RPC pcnfsd service allows remote command execution as root (PcnfsdExec) . . . . . . . . . . Perl fingerd program allows remote users to execute commands (Finger_Perl) . . . . . . . . . phAse zero backdoor for Windows 95/98 and NT (PhaseZero) . . . . . . . . . . . . . . . . . . . Ping Flood (PingFlood) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ping of Death (PingOfDeath) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Portmapper program dump lists RPC programs (PmapDump) . . . . . . . . . . . . . . . . . . . . NFS portmapper export (PmapMnt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 471 472 473 473 474 475 475 476 477 477 478 479 479 480 482 483 484 485 486 487 488 489 491 492 492 493 493 494 495 496 497 498 499 501 506 506 507 508 509 509 510 511 511 512 513 514 514 515 516 517 518 519 520 522 522 xvii Contents Portmapper proxy call (PmapProxy) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524 Portmap SET procedure requested (PmapSet) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524 Portmap SET procedure requested with spoofed address (PmapSetSpoof) . . . . . . . . . . . . . . . . . . . . 525 Portmap UNSET procedure requested (PmapUnset) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526 Portmap UNSET procedure requested with spoofed address (PmapUnsetSpoof) . . . . . . . . . . . . . . . . 526 University of Washington POP2 daemon remote buffer overflow (POP_Fold_Overflow) . . . . . . . . . . . . . 527 Fuseware Fusemail POP mail service buffer overflow (POP_Fuseware_Overflow) . . . . . . . . . . . . . . . . . 528 Qpopper LIST buffer overflow (POP_List_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529 Microsoft Outlook date header buffer overflow (POP_Outlook_Date_Overflow). . . . . . . . . . . . . . . . . . . 530 Popd buffer overflow gains root access (POP_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 532 POP password (POP_Password) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533 Qpopper auth command buffer overflow (POP_QPopAuth_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . 534 Qpopper contains a buffer overflow that could allow root access (POP_QPopCommand_Overflow). . . . . 535 Qpopper long username buffer overflow (POP_QPopUser_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . 536 Internet Anywhere Mail Server RETR denial of service (POP_Retr_DoS) . . . . . . . . . . . . . . . . . . . . . . 537 SilentRunner Collector 'POP PASS' remote buffer overflow (POP_SilentRunner_Pass_Overflow) . . . . . . . 538 SilentRunner Collector 'POP USER' remote buffer overflow (POP_SilentRunner_User_Overflow) . . . . . . . 538 POP username (POP_User) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539 Portscan attack (Port_Scan) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 Portal of Doom backdoor for Windows (PortalOfDoom) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541 Older versions of ComOS could be crashed remotely (Portmaster_Reboot) . . . . . . . . . . . . . . . . . . . . 542 Windows 2000 Kerberos pre-authentication failed (Preauthentication_failed) . . . . . . . . . . . . . . . . . . 543 Service processes can be used to remotely manipulate a system (Privileged_service_called) . . . . . . . . 544 File access attempted for important files (Probing_of_important_files) . . . . . . . . . . . . . . . . . . . . . . . 544 Progenic backdoor for Windows 95/98 and NT (Progenic) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 545 Process execution initiated (Program_execution_started) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 546 Process execution exited (Program_exited) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 547 Prosiak backdoor for Windows (Prosiak) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 547 Qaz backdoor for Windows (Qaz_Command) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549 Qaz backdoor for Windows (Qaz_Connect). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550 Remote Unix syslog message from Qpopper: authentication access problem (Qpopper_Auth_failed) . . . 551 Remote Unix syslog message from Qpopper: permission access problem (Qpopper_Permission_Problem) . 552 Remote Unix syslog message from Qpopper (QPopper_possible_user_probe) . . . . . . . . . . . . . . . . . . 553 Remote Unix syslog message from Qpopper (QPopper_user_login_failure) . . . . . . . . . . . . . . . . . . . . 553 Remote Unix syslog message from Qpopper: excessive user name (Qpopper_Username_too_long) . . . 554 Quake III Arena auto-download allows servers to access clients' file systems (Quake3Arena_Vulnerable_Client) 555 Quake III Arena auto-download allows servers to access clients' file systems (Quake3Arena_Vulnerable_Server) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 556 Queso utility can remotely identify operating systems (Queso_Scan) . . . . . . . . . . . . . . . . . . . . . . . . . 558 RAS user connection terminated - inconsistent authentication principal (ras_auth_rasfail) . . . . . . . . . . 559 RAS user connection terminated - authentication timeout (ras_auth_timeout) . . . . . . . . . . . . . . . . . . 560 RAS user connection terminated - no remote access privileges (ras_noaccess). . . . . . . . . . . . . . . . . 560 RealSecure TCP RST kill action detected (RealSecure_Kill) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561 Linux lpd could be used to pass arguments to sendmail (RedHat_Lpd_Print_Control) . . . . . . . . . . . . . 562 Registry autorun changed (Registry_autorun_changed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 564 Registry eventlog settings changed (Registry_eventlog_settings_changed). . . . . . . . . . . . . . . . . . . . . 565 Registry security options changed (Registry_NT_security_options_changed) . . . . . . . . . . . . . . . . . . . 566 Registry remote edit changed (Registry_remote_edit_changed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 Remote root login success detected (Remote_root_login) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 568 Remote user login success detected (Remote_user_login) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 569 Remote Storm backdoor for Windows (RemoteStorm) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 570 RemoteWatch allows root-level access (RemoteWatch). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 571 RWS backdoor for Windows (RemoteWindowsShutdown) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 572 Rexd running (Rexd) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 572 xviii Contents Rexec session (Rexec) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ringzero virus (Ringzero) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RIP entry added (RIPAdd) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RIP Entry timeout (RIPExpire) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RIP Metric change (RIPMetricChange) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Rlogin -froot command could allow remote root access (Rlogin_Froot) . . . . . . . . . . . . . . . . . . Rlogin (Rlogin_Session) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Enterasys RoamAbout Access Point console password disabled (SNMP_Suspicious_Set) . . . . . Enterasys RoamAbout Access Point Secure Access mode disabled (SNMP_Suspicious_Set) . . . Enterasys RoamAbout Access Point WEP encryption (SNMP_Suspicious_Set) . . . . . . . . . . . . . Core file owned by root opened (Root_core_access) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Directory starting with ". " has been created (Rootkit_install) . . . . . . . . . . . . . . . . . . . . . . . . CDE rpc.cmsd server remotely exploitable buffer overflow (RPC_Cmsd_Overflow) . . . . . . . . . . . Solaris snmpXdmid malformed DMI request buffer overflow (RPC_snmpXdmid_Overflow) . . . . . Rsh (Rsh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Rux Tick backdoor for Windows (RuxTick) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Rwhod daemon running (Rwhod_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Rwho daemon overflow (Rwhod_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . System Scanner scan completed (S2_Scan_Completed). . . . . . . . . . . . . . . . . . . . . . . . . . . . System Scanner scan started (S2_Scan_Started) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . System Scanner scan detected a vulnerability (S2_Scan_Vulnerability_Found) . . . . . . . . . . . . . Solaris Solstice AdminSuite (sadmind) daemon buffer overflow (Sadmind_Amslverify_Overflow) . . Solaris Solstice admin daemon ping procedure (Sadmind_Ping) . . . . . . . . . . . . . . . . . . . . . . . SATAN is an automated network vulnerability scanner (Satan) . . . . . . . . . . . . . . . . . . . . . . . Satan's Backdoor for Windows (SatansBackdoor) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Schwindler backdoor for Windows 95/98 (Schwindler) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Logon attempt failure reported by Windows Service Control Manager (scm_logon_fail) . . . . . . . Windows resources for queuing of audit messages have been exhausted (sec_auditlost) . . . . . SecretService backdoor for Windows 95/98 (SecretService). . . . . . . . . . . . . . . . . . . . . . . . Global distribution group changed (Security_disabled_global_group_changed). . . . . . . . . . . . . . Global distribution group created (Security_disabled_global_group_created). . . . . . . . . . . . . . . Global distribution group deleted (Security_disabled_global_group_deleted) . . . . . . . . . . . . . . . Global distribution group membership modified - member added (Security_disabled_global_group_member_added) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Global distribution group membership modified - member removed (Security_disabled_global_group_member_removed) . . . . . . . . . . . . . . . . . . . . . . . . . . . Local distribution group changed (Security_disabled_local_group_changed) . . . . . . . . . . . . . . . Local distribution group created (Security_disabled_local_group_created) . . . . . . . . . . . . . . . . Local distribution group deleted (Security_disabled_local_group_deleted). . . . . . . . . . . . . . . . . Local distribution group membership modified - member added (Security_disabled_local_group_member_added) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Local distribution group membership modified - member removed (Security_disabled_local_group_member_removed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Universal distribution group changed (Security_disabled_universal_group_changed) . . . . . . . . . Universal distribution group created (Security_disabled_universal_group_created) . . . . . . . . . . Universal distribution group deleted (Security_disabled_universal_group_deleted) . . . . . . . . . . . Universal distribution group membership modified - member added (Security_disabled_universal_group_member_added) . . . . . . . . . . . . . . . . . . . . . . . . . . . Universal distribution group membership modified - member removed (Security_disabled_universal_group_member_removed) . . . . . . . . . . . . . . . . . . . . . . . . . Security enabled universal group changed (Security_enabled_universal_group_changed) . . . . . . Security enabled universal group created (Security_enabled_universal_group_created) . . . . . . . Security enabled universal group deleted (Security_enabled_universal_group_deleted) . . . . . . . . Security enabled universal group membership modified - member added (Security_enabled_universal_group_member_added) . . . . . . . . . . . . . . . . . . . . . . . . . . . Security enabled universal group membership modified - member removed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 574 575 576 577 578 578 579 580 581 582 583 584 584 586 587 588 588 589 590 591 592 592 594 594 596 597 598 599 599 600 601 602 . . . . . 602 . . . . . . . . . . . . . . . . . . . . 603 604 604 605 . . . . . 606 . . . . . . . . . . . . . . . . . . . . 606 607 608 608 . . . . . 609 . . . . . . . . . . . . .. .. .. .. 610 610 611 612 . . . . . 613 xix Contents (Security_enabled_universal_group_member_removed). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 613 Remote file access through selection service holdfile (SelSvcH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 614 RealSecure sensor error message (Sensor_Error) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615 RealSecure sensor information message (Sensor_Info) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 616 RealSecure sensor warning message (Sensor_Warning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617 ServeMe backdoor for Windows 95/98 (ServeMe) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618 Service ticket granted to a Windows 2000 security principal (Service_ticket_granted) . . . . . . . . . . . . 618 Service ticket request failed (Service_ticket_request_failed). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 619 Service scanner attempting to connect to same port on multiple computers (ServiceScan) . . . . . . . . . 620 Windows 2000 logon session disconnected (Session_disconnected) . . . . . . . . . . . . . . . . . . . . . . . . 620 Windows 2000 logon session reconnected (Session_reconnected) . . . . . . . . . . . . . . . . . . . . . . . . . 621 SLmail HELO command buffer overflow (Email_Helo_Overflow). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 622 SLmail VRFY and EXPN commands can crash server (Email_Expn_Overflow) . . . . . . . . . . . . . . . . . . . 622 SMB cleartext password (SMB_Client_Cleartext_Password) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623 Windows NT SMB logon denial of service (SMB_Malformed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624 Samba SMB password buffer overflow (SMB_Password_Overflow). . . . . . . . . . . . . . . . . . . . . . . . . . 625 SMTP Exchange denial of service (Email_Helo_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626 SMTP servers may perform third-party relaying on UUCP style addresses (Email_Relay_Spam) . . . . . . 627 Sendmail overflows in EXPN and VRFY could allow remote access (Email_Expn_Overflow) . . . . . . . . . . 628 Smurf denial of service (Smurf) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629 Snid X2 backdoor for Windows (SnidX2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630 SniperNet backdoor for Windows 95/98 (SniperNet) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 631 SNMP agents can be instructed not to notify management stations (SNMP_Suspicious_Get). . . . . . . . 632 SNMP kill interface (SNMP_Suspicious_Get). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633 SNMP agents reveal information about network interfaces (SNMP_Suspicious_Get) . . . . . . . . . . . . . . 634 SNMP RMON agents can monitor network and application activity (SNMP_Suspicious_Get). . . . . . . . . 634 SNMP agents reveal information about network routing (SNMP_Suspicious_Get) . . . . . . . . . . . . . . . . 635 SNMP messages (SNMP_Activity) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636 SNMP community string (SNMP_Community). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636 WINS records deletion using SNMP (SNMP_Delete_WINS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 637 SNMP_Set can modify SNMP variables (SNMP_Set) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 638 SNMP suspicious GET (SNMP_Suspicious_Get). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639 SNMP suspicious SET (SNMP_Suspicious_Set) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 640 Solaris Snoop GETQUOTA decoding buffer overflow (Snoop_GetQuota_Overflow). . . . . . . . . . . . . . . . . 641 Sockets de Troie (Socket23) backdoor for Windows (Sockets_de_Troie) . . . . . . . . . . . . . . . . . . . . . . 642 Solaris in.lpd print protocol daemon buffer overflow (Solaris_LPD_Overflow) . . . . . . . . . . . . . . . . . . . 643 Routing IP packets through different paths can avoid filtering routers (SourceRoute) . . . . . . . . . . . . . 645 Microsoft SQL Server login failed (SQLServer_login_failed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 646 Microsoft SQL Server login failed - user not Administrator (SQLServer_login_failed_not_administrator) . 646 Microsoft SQL Server login failed - user not trusted (SQLServer_login_failed_not_trusted) . . . . . . . . . . 647 Microsoft SQL Server login failed - invalid user (SQLServer_login_failed_not_valid_user) . . . . . . . . . . . . 647 Microsoft SQL Server login failed - too many users (SQLServer_login_failed_too_many_users) . . . . . . . 648 SSH2 - Agent forwarding denied (SSH2_Agent_forwarding_denied) . . . . . . . . . . . . . . . . . . . . . . . . . 649 SSH2 - User authentication failed due to non-user specific reason (SSH2_Common_auth_failed_host) . . 650 SSH2 - User authentication failed due to user specific reason (SSH2_Common_auth_failed_user). . . . . 651 SSH2 - DNS lookup failed (SSH2_DNS_lookup_failed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651 SSH2 - host-based authentication failed, possible DNS spoofing (SSH2_Hostbased_auth_failed_DNS_spoofing) 652 SSH2 - host-based authentication failed for user-specific reason (SSH2_Hostbased_auth_failed_for_user) . . 653 SSH2 - host-based authentication failed, root login not allowed (SSH2_Hostbased_auth_failed_no_root). 654 SSH2 - host-based authentication failed, packet error (SSH2_Hostbased_auth_failed_packet_error) . . . 654 SSH2 - host-based authentication failed, public key (SSH2_Hostbased_auth_failed_pubkey) . . . . . . . . . 655 SSH2 - host-based authentication successful (SSH2_Hostbased_auth_successful) . . . . . . . . . . . . . . . 656 SSH2 - illegal port forwarding (SSH2_Illegal_port_forwarding) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 xx Contents SSH - Kerberos authentication failed (SSH2_Kerberos_auth_failed) . . . . . . . . . . . . . . . . . . . . . . . . . SSH - Kerberos authentication successful (SSH2_Kerberos_auth_successful) . . . . . . . . . . . . . . . . . . SSH2 - user login successful (SSH2_Login_General) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH2 - PAM authentication failed (SSH2_Pam_auth_failed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH2 - password authentication failure, empty password (SSH2_Passwd_auth_failed_empty_passwd) . SSH2 - password authentication failure, root login not allowed (SSH2_Passwd_auth_failed_root) . . . . . SSH2 - password authentication failure, wrong password (SSH2_Passwd_auth_failed_wrong_passwd) . SSH - successful password authentication (SSH2_Passwd_auth_successful) . . . . . . . . . . . . . . . . . . . SSH2 - public key authentication failed (SSH2_Pubkey_auth_failed). . . . . . . . . . . . . . . . . . . . . . . . . . SSH2 - public key authentication failed, root login denied (SSH2_Pubkey_auth_failed_root). . . . . . . . . . SSH2 - public key authentication successful (SSH2_Pubkey_auth_successful) . . . . . . . . . . . . . . . . . . SSH - Rhosts authentication attempt refused (SSH2_Rhosts_auth_failed) . . . . . . . . . . . . . . . . . . . . . SSH2 - SSH1 agent forwarding denied (SSH2_SSH1_Agent_forwarding_denied) . . . . . . . . . . . . . . . . SSH2 - TCP/IP forwarding denied (SSH2_TCPIP_forwarding_denied) . . . . . . . . . . . . . . . . . . . . . . . . SSH - username length overflow attack (SSH2_Username_too_long) . . . . . . . . . . . . . . . . . . . . . . . . SSH - agent authentication failure (SSH_agent_auth._failure) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - command execution (SSH_command_execution) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - connection success (SSH_connection) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - connection for user not allowed (SSH_connection_for_user_not_allowed) . . . . . . . . . . . . . . . . . SSH - connection for user not allowed from host (SSH_connection_for_user_not_allowed_From_Host). . SSH Server, Connection from host not allowed (SSH_connection_from_host_not_allowed) . . . . . . . . . . Secure Shell (SSH) session (SSH_Detected) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - no reverse mapping (SSH_DNS_spoofing_attack-no_reverse_mapping). . . . . . . . . . . . . . . . . . . SSH - reverse mapping different (SSH_DNS_spoofing_attack-reverse_mapping_different). . . . . . . . . . . SSH - IP options used (SSH_IP_options_used) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - Kerberos authentication failed (SSH_Kerberos_auth._failed) . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - Kerberos authentication successful (SSH_Kerberos_auth._successful). . . . . . . . . . . . . . . . . . . SSH - Kerberos KDC possible spoofing (SSH_Kerberos_KDC_possible_spoofing) . . . . . . . . . . . . . . . . SSH - Kerberos password authentication failed (SSH_Kerberos_password_auth._failed) . . . . . . . . . . . SSH - Kerberos TGT not verified (SSH_Kerberos_TGT_not_verified) . . . . . . . . . . . . . . . . . . . . . . . . . SSH - Kerberos TGT rejected (SSH_Kerberos_TGT_rejected). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - Kerberos ticket authentication failed (SSH_Kerberos_ticket_auth._failed) . . . . . . . . . . . . . . . . . SSH - OSF-1 security level (SSH_OSF-1_security_level) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - Rhosts authentication attempt from unprivileged port (SSH_Rhosts_auth._attempt_from_unprivileged_port). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - Rhosts authentication attempt refused (SSH_Rhosts_auth._refused) . . . . . . . . . . . . . . . . . . . . SSH - Root command execution (SSH_Root_command_execution) . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - root login (SSH_Root_login). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - RSA authentication failed (SSH_RSA_auth._failed). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - RSA authenticated from restricted host (SSH_RSA_auth._from_restricted_host) . . . . . . . . . . . . SSH - RSA authentication refused (SSH_RSA_auth._refused) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SSH - SecurID authentication required (SSH_SecurID_auth._required) . . . . . . . . . . . . . . . . . . . . . . . SSH - successful password authentication (SSH_Successful_password_auth.) . . . . . . . . . . . . . . . . . . SSH - Rhosts authentication successful (SSH_Successful_rhosts_auth.) . . . . . . . . . . . . . . . . . . . . . . SSH - username length overflow attack (SSH_User_name_length_overflow_attack) . . . . . . . . . . . . . . . Stacheldraht distributed denial of service tool (Stacheldraht_DOS) . . . . . . . . . . . . . . . . . . . . . . . . . . StarTech POP3 proxy contains a buffer overflow that can crash the service (POP_Overflow) . . . . . . . . Important programs started (Startup_of_important_programs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . automountd allows users to change mount options (Statd_Automount_Exec). . . . . . . . . . . . . . . . . . . RPC statd remote file creation and removal (Statd_DotDot) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Linux rpc.statd/kstatd server allows remote code execution (Statd_Format_Attack). . . . . . . . . . . . . . RPC statd daemon buffer overflow (Statd_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . StealthSpy backdoor for Windows (StealthSpy) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Stream.c denial of service (Stream_DoS). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SubSeven backdoor for Windows (SubSeven) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 658 658 659 660 660 661 662 663 663 664 665 665 666 667 667 668 669 669 670 671 671 672 673 673 674 675 675 676 677 677 678 679 679 680 681 681 682 682 683 684 684 685 686 686 691 691 692 694 696 698 699 700 702 xxi Contents SubSeven backdoor for Windows (SubSeven_Scan) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User login successful (Successful_login) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Successful network login (Successful_Network_login). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sun SNMP hidden community string (Sun_SNMP_Backdoor) . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to Finger port (Suspect_Finger) . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to FTP port (Suspect_FTP). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to IMAP port (Suspect_IMAP) . . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to Netbus port (Suspect_Netbus) . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to Netstat port (Suspect_Netstat) . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to POP2 port (Suspect_POP2) . . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to POP3 port (Suspect_POP3) . . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection attempts to common service ports (Suspect_portscan) . . . . . . . . . . Suspicious TCP connection to SMTP port (Suspect_SMTP). . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to SSH port (Suspect_SSH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to Sunrpc port (Suspect_Sunrpc) . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to Systat port (Suspect_Systat) . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to Telnet port (Suspect_Telnet) . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to Time port (Suspect_Time) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to Whois port (Suspect_Whois) . . . . . . . . . . . . . . . . . . . . . . . . . . Suspicious TCP connection to WWW port (Suspect_WWW) . . . . . . . . . . . . . . . . . . . . . . . . . Swift Remote backdoor for Windows 95/98 (Swift) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sybase failed connection (Sybase_Failed_Connection). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sybase configuration file not specified (Sybase_No_Configuration_File) . . . . . . . . . . . . . . . . . . . Sybase shutdown (Sybase_Shutdown) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sybase startup (Sybase_Startup) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sybase successful connection (Sybase_Successful_Connection). . . . . . . . . . . . . . . . . . . . . . . . SYN flood denial of service (SYNFlood) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Syphillis backdoor for Windows 95/98 (Syphillis) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Syphillis backdoor for Windows 95/98 (Syphillis_Scan) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . System time changed (System_time_changed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Talk flash attack (Talk_Flash) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Talk request (Talk_Request). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . IP hijacking allows attackers to execute commands into someone's session (TCP_Hijacking_Tool) . TCP segments with overlapping data that did not match (TCP_Overlap_Data) . . . . . . . . . . . . . . TCP Port bind (TCP_Port) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Out of band data can be used for IDS evasion (TCP_Urgent_Data) . . . . . . . . . . . . . . . . . . . . . . Modified teardrop denial of service (TearDrop) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Teardrop IP fragmentation (TearDrop) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Telecommando backdoor for Windows 95/98 (TeleCommando). . . . . . . . . . . . . . . . . . . . . . . Kerberos4 telnet authentication (TelnetAuthKerb4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Kerberos5 telnet authentication (TelnetAuthKerb5). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Loki telnet authentication (TelnetAuthLoki) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Null telnet authentication (TelnetAuthNull) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RSA telnet authentication (TelnetAuthRsa). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SPX telnet authentication (TelnetAuthSpx) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Username telnet authentication (TelnetAuthUser) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Long username telnet authentication (TelnetAuthUserLong) . . . . . . . . . . . . . . . . . . . . . . . . . . Telnet environment variables (TelnetEnvAll) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Long telnet environment variables (TelnetEnvLong) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Telnet termcap environment variable (TelnetEnvTermcap) . . . . . . . . . . . . . . . . . . . . . . . . . . . BSD-derived telnetd options 'telrcv' buffer overflow (TelnetExcessiveAYTs). . . . . . . . . . . . . . . . . Telnet excessive tabs (TelnetExcessiveTabs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dynamic Linker telnet gains root access (TelnetLinkerBug). . . . . . . . . . . . . . . . . . . . . . . . . . . Telnet terminal type (TelnetTerminaltype). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Telnet long terminal type option (TelnetTerminaltypeLong) . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 703 704 705 706 707 708 708 709 710 711 711 712 713 714 714 715 716 717 717 718 719 720 721 722 722 723 724 725 726 728 728 729 729 730 731 732 732 733 735 736 736 737 738 738 739 739 740 741 741 742 743 746 747 749 749 Contents Telnet X Display (TelnetXdisplay). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Telnet long X Display type (TelnetXdisplayLong). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tribe Flood Network 2000 DDoS tool (TFN2000). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . TFTP GET command (TFTP_Get). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . TFTP PUT command (TFTP_Put) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Thing backdoor for Windows (TheThing) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows 2000 Kerberos ticket renewed (Ticket_granted_renewed) . . . . . . . . . . . . . . . . . . . . . . . . Tini backdoor for Windows (Tini) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tivoli LCF HTTP interface has a default password (Tivoli_LCF_Default_Password) . . . . . . . . . . . . . . . . Tivoli LCF httpd can be used to remotely access files as root (Tivoli_LCF_File_Read) . . . . . . . . . . . . . . ToolTalk CDE rpc.ttdbserver daemon buffer overflow (ToolTalk_Overflow) . . . . . . . . . . . . . . . . . . . . . Total Eclypse backdoor FTP server for Windows (TotalEclypse) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Traceroute can be used to map network topologies (Trace_Route) . . . . . . . . . . . . . . . . . . . . . . . . . TransScout backdoor for Windows (TransScout) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tribe Flood Network denial of service tool (Tribe_Flood_Network). . . . . . . . . . . . . . . . . . . . . . . . . . . Trin00 DDoS tool - Daemon activity (TrinooDaemon) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Trin00 DDoS tool - daemon registration attempt (TrinooDaemonRegister) . . . . . . . . . . . . . . . . . . . . Trinoo DDoS tool - Master connection attempt (TrinooMasterAttempt) . . . . . . . . . . . . . . . . . . . . . . Trin00 DDoS tool - Master successful connection (TrinooMasterConnect) . . . . . . . . . . . . . . . . . . . . Trusted domain relationship added between two domains (Trusted_domain_added) . . . . . . . . . . . . . . Trusted domain relationship removed between two domains (Trusted_domain_removed) . . . . . . . . . . Truva 1.2 backdoor for Windows 95/98 (Truva) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . UDP denial of service attacks (Echo_Denial_of_Service) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User Datagram Protocol (UDP) scan for active ports (UDP_Port_Scan) . . . . . . . . . . . . . . . . . . . . . . SunOS can be crashed with malformed UDP packets (UDPBomb) . . . . . . . . . . . . . . . . . . . . . . . . . . Ultors backdoor for Windows (Ultors) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Unexplained 1.0 backdoor for Windows 95/98 and NT (Unexplained) . . . . . . . . . . . . . . . . . . . . Root login successful from Unix tty (UNIX_Root_Login_Successful). . . . . . . . . . . . . . . . . . . . . . . . . . Unix root su failure (UNIX_Root_Su_Failure) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Unix root su successful (UNIX_Root_Su_Successful) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User rights exercised successfully (Use_of_user_rights) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User account modified (User_account_changed) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows NT user account created (User_account_created). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows NT user account deleted (User_account_deleted) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows NT user account disabled (User_account_disabled) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows NT user account enabled (User_account_enabled). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows 2000 user account locked out (User_account_locked_out) . . . . . . . . . . . . . . . . . . . . . . . . Windows 2000 account used for logon (User_account_used_for_logon). . . . . . . . . . . . . . . . . . . . . . User account added to global administrator group (User_added_to_global_admin_group) . . . . . . . . . . User account added to local administrator group (User_added_to_local_admin_group) . . . . . . . . . . . . Administrative privileges granted to a user or group (User_admin_right_granted) . . . . . . . . . . . . . . . Administrative privileges revoked from a user or group (User_admin_right_revoked). . . . . . . . . . . . . . User environment file opened (User_environment_file_change) . . . . . . . . . . . . . . . . . . . . . . . . . . . . User logout occurred (User_logout) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User account granted additional privileges (User_right_granted) . . . . . . . . . . . . . . . . . . . . . . . . . . . User account had specific privileges revoked (User_right_revoked) . . . . . . . . . . . . . . . . . . . . . . . . . TCPIP.sys Land exploit (Land) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Virtual Network Computing server detected (VNC_Detected) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . WinVNC DebugLevel > 0 HTTP logging buffer overflow (VNC_HTTP_Get_Overflow) . . . . . . . . . . . . . . . VNC connection attempt failed due to bad password (VNC_Login_Failed) . . . . . . . . . . . . . . . . . . . . . VNC No Authentication Required (VNC_NoAuthentication) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . WinVNC client rfbConnFailed reason string buffer overflow (VNC_RFBConnFailed_Overflow) . . . . . . . . . Malformed IGMP packet could cause some systems to crash or hang (Win_IGMP_DOS) . . . . . . . . . . Windows allows source routing when configured to reject source routed packets (Win_IP_Src_Route) . Windows file-sharing access error (Windows_Access_Error) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 750 750 751 753 754 755 756 757 758 758 759 760 761 762 763 765 769 771 773 775 776 777 778 779 780 780 781 782 783 783 784 785 785 786 787 788 788 789 790 791 791 792 793 793 794 795 795 796 797 798 799 800 800 802 803 xxiii Contents LSA connect (Windows_LSA_Connect) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows null session (Windows_Null_Session) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Out of Band (OOB) data denial of service (Windows_OOB). . . . . . . . . . . . . . . . . . . . . . . . . . . . Password cache files accessible (Windows_PWL_Access) . . . . . . . . . . . . . . . . . . . . . . . . . . . Windows registry can be opened remotely (Windows_Registry_Read) . . . . . . . . . . . . . . . . . . . WinGate POP3 proxy long username overflow (POP_Overflow) . . . . . . . . . . . . . . . . . . . . . . . . Wu-ftpd allows local users to gain root privileges (FTP_Site_Cmd) . . . . . . . . . . . . . . . . . . . . . . WU-FTPD allows remote code execution with special SITE EXEC commands (FTP_Format_String). Y3K RAT backdoor for Windows (Y3K_RAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ypupdated daemon allows remote command execution (Ypupdate_Exec) . . . . . . . . . . . . . . . . . xxiv . . . . . . . . . . . . . . . . . . . . .. .. .. .. .. .. .. .. .. .. 804 805 805 807 809 810 811 812 814 816 3Com AirConnect Access Point "Accepts Broadcast Wireless LAN Service Area" feature is enabled (SNMP_Suspicious_Set) About this signature or vulnerability This signature detects an attempt to read or change the "Accept Broadcast Wireless LAN Service Area" feature of a 3com Wireless Access Point. This is detected by the SNMP_Suspicious_Get signature. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description The 3Com AirConnect Access Point installation process allows the installer to specify whether Access Point should accept and respond to wireless client probe packets. A standard Access Point probe response includes the Wireless LAN Service Area ID (SSID) and other information about the network. When the "Accept Broadcast Wireless LAN Service Area" feature is enabled, any wireless client can associate with the Access Point without any prior knowledge of the Wireless LAN Service Area ID of the Access Point. As a result, any malicious user can establish an association with the Access Point to exploit the network. By default, the "Accept Broadcast Wireless LAN Service Area" feature is disabled. As listed in the 3ComAP MIB (Management Information Base), enabling this feature is not recommended. Enabling this feature may weaken the wireless network's authentication security. How to remove this vulnerability Disable the "Accept Broadcast Wireless LAN Service Area" feature. To disable the "Accept Broadcast Wireless LAN Service Area" feature: 1. Open a Web browser (for example, Microsoft Internet Explorer). 2. Type the IP address of the 3Com AirConnect Access Point of interest in the browser's Address field, then press Enter. 3. In the Access Point frame, click Access Point to expand the Access Point sub-tree. 4. Click Configuration to expand the Configuration sub-tree. 5. Click "RF." 6. Type the appropriate user name and password when prompted. 7. Under the RF Setup frame, select "Disabled" for "Accept Broadcast Wireless LAN Service Area." 8. Click Save. 1 3Com AirConnect Access Point "Access Control" function is disabled (SNMP_Suspicious_Set) References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Access Point "Accepts Broadcast Wireless LAN Service Area" feature is enabled http://xforce.iss.net/static/6272.php 3Com AirConnect Access Point "Access Control" function is disabled (SNMP_Suspicious_Set) About this signature or vulnerability This signature detects an attempt to read or change the MAC address access control configuration on a 3com Wireless Access Point. This is detected by the SNMP_Suspicious_Get signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description 3Com AirConnect Access Point, in addition to standard SSID (Service Set Identifier) and WEP (Wired Equivalent Privacy) encryption, supports an Access Control function that allows an administrator to configure access control lists for tighter security. Using the Access Control function, you can require that only wireless clients with known MAC addresses are allowed to associate with the Access Point, while devices with unknown MAC addresses are not allowed to join the wireless network. By default, the 3Com AirConnect Access Point ships with the Access Control function disabled. Though this function is not part of the IEEE 802.11 standard and does not cover stolen equipment, it is a good security practice to enable the Access Control function. Using this function, you can configure the access control list to prevent unauthorized access of wireless networks by unknown wireless clients. How to remove this vulnerability Enable the 3Com AirConnect Access Point Access Control function and use this function to allow or disallow wireless clients in accordance with your security management policy. To enable the 3Com AirConnect Access Point Access Control function and configure the access control lists: 1. Open a Web browser (for example, Microsoft Internet Explorer). 2. Type the IP address of the 3Com AirConnect AP-4111 Access Point of interest in the Address field of the browser, and then press Enter. 3. In the Access Point frame, click Access Point to display the Access Point sub-tree. 2 3Com AirConnect Access Point Access Control Violation Trap is disabled (SNMP_Suspicious_Set) 4. Click Configuration to display the Configuration sub-tree, and then click "Security." 5. Type the appropriate username and password when prompted. 6. Under the Security Setup frame, find the Access Control setting, and select "Enabled." 7. Configure the Allowed Wireless Clients, Ranges of Allowed Wireless Clients, and Disallowed Wireless Clients access control lists, in accordance with your security management policy. 8. Click Save. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Access Point "Access Control" function is disabled http://xforce.iss.net/static/6274.php 3Com AirConnect Access Point Access Control Violation Trap is disabled (SNMP_Suspicious_Set) About this signature or vulnerability This signature detects an attempt to enable or disable SNMP traps on a 3com Wireless Access Point. This is detected by the SNMP_Suspicious_Get signature. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description The 3Com AirConnect Access Point SNMP agent supports its own enterprise- specific access violation trap: the ap3ComACLViolationTrap. The ap3ComACLViolationTrap can alert a network administrator of unauthorized access attempts by sending any wireless client that is not in the AP Access Control List to the network management station. The MAC address of an offending wireless client is included in the trap variable binding list and can be useful information for tracing purposes. By default, the 3Com AirConnect Access Point ships with all SNMP traps disabled. For installations that have access control lists enabled, it is important to also enable the access control violation trap. Enabling the access control violation trap will allow for real-time responses to potential unauthorized access attempts to the wireless network. How to remove this vulnerability Enable the 3Com AirConnect Access Point Access Control Violation trap. 3 3Com AirConnect Access Point ships with default wireless LAN Service Area ID (SNMP_Suspicious_Set) To enable the 3Com AirConnect Access Point Access Control Violation trap: 1. Open a Web browser (for example, Microsoft Internet Explorer). 2. Type the IP address of the 3Com AirConnect Access Point of interest in the Address field of the browser, then press Enter. 3. In the Access Point frame, click Access Point to display the Access Point sub-tree. 4. Click Configuration to display the Configuration sub-tree. 5. Click "SNMP." 6. Type the appropriate username and password when prompted. 7. Under the SNMP Setup section, ensure that SNMP Agent Mode is not "Disabled" (the default setting is "Read-Write"). 8. Ensure that both the "Trap Host 1 IP address" and the "Trap Host 2 IP address" are properly configured. 9. Under the SNMP Traps section, select "Enable Selected" for All SNMP Traps (the default setting is "Disable All"). 10. Select either "Trap Host 1" or "Trap Host 2," or select "Both Trap Hosts" for Access Control Violation (the default setting is "Deselected"). 11. Click Save. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Access Point Access Control Violation Trap is disabled http://xforce.iss.net/static/6280.php 3Com AirConnect Access Point ships with default wireless LAN Service Area ID (SNMP_Suspicious_Set) About this signature or vulnerability This signature detects an attempt to read or write the SSID of a 3com Wireless Access Point. This is detected by the SNMP_Suspicious_Get signature. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description 3Com AirConnect Access Points ship with a default, installed LAN Service Area ID (also known as the SSID - Service Set Identifier). This default SSID is "101." If WEP (Wired 4 3Com AirConnect Access Point telnet logins enabled (SNMP_Suspicious_Set) Equivalent Privacy) encryption is not enabled, this default SSID is the only information a wireless client would need to submit to the Access Point in order to establish an association. If this default SSID is not changed, any user with basic knowledge of 3Com AirConnect Access Points can use this SSID to gain access to the wireless network. How to remove this vulnerability Change the wireless LAN Service Area ID (SSID). To change the wireless LAN Service Area ID (SSID): 1. Open a Web browser (for example, Microsoft Internet Explorer). 2. Type the IP address of the 3Com AirConnect Access Point of interest in the Address field of the browser, then press Enter. 3. In the Configuration Management System frame, click Easy Setup. 4. Enter the appropriate username and password when prompted. 5. In the Easy Setup frame, type the new SSID in the Wireless LAN Service Area box. 6. Click Save Settings. 7. Reset the 3Com AirConnect Access Point. (The new settings do not take effect until the Access Point is restarted.) References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Access Point ships with default wireless LAN Service Area ID http://xforce.iss.net/static/6266.php 3Com AirConnect Access Point telnet logins enabled (SNMP_Suspicious_Set) About this signature or vulnerability This signature detects an attempt to enable or disable telnet access to a 3com Wireless Access Point. This is detected by the SNMP_Suspicious_Get signature. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description 3Com AirConnect Access Points ship with telnet remote management capability enabled by default. This telnet capability is one of several remote management capabilities 5 VTCP.386 is out of date (Land) provided by 3Com AirConnect Access Points. Telnet allows remote administration of the Access Point without a graphical user interface or local console attachment. 3Com AirConnect Access Point's telnet capability could allow a malicious user to execute brute-force login attempts without being detected by the network administrator. Invalid password events can be recorded in the Access Point local event log. However, unlike the Access Point's SNMP authentication trap, administrators are not notified of these events in real-time. Also, the Access Point local event log is stored in a 128-entry circular buffer, which could allow a malicious user to overwrite the log to remove evidence. How to remove this vulnerability Based on your security administration policy, determine the management method (SNMP, telnet, Web, or console) required for your implementation of 3Com AirConnect Access Point. If telnet logins are not required, disable telnet logins for the 3Com AirConnect Access Point. To disable telnet logins for the 3Com AirConnect Access Point: 1. Open a Web browser (for example, Microsoft Internet Explorer). 2. Type the IP address of the 3Com AirConnect Access Point of interest in the Address field of the browser, then press Enter. 3. In the Access Point frame, click Access Point to display the Access Point sub-tree. 4. Click Configuration to display the Configuration sub-tree. 5. Click Security. 6. Type the appropriate username and password when prompted. 7. Under the Security Setup frame, select "Disabled" for Telnet Logins. 8. Click the Save Settings box. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Access Point telnet logins enabled http://xforce.iss.net/static/6278.php VTCP.386 is out of date (Land) About this signature or vulnerability This vulnerability is detected by the Land signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 2.0 Systems affected Windows 95 6 Account policy was changed (Account_policy_change) Type Denial of Service Vulnerability description The version of vtcp.386 is vulnerable to the Land exploit. How to remove this vulnerability Apply the latest Windows NT 4.0 Service Pack (SP4 or later), available from the Windows NT Service Packs Web page. See References. — OR — As an alternative, Windows SP3 users can apply the post-SP3 teardrop2-fix patch, as listed in Microsoft Knowledge Base Article Q165005. See References. — AND — Apply the Winsock 2 update, as listed in Microsoft Knowledge Base Article Q177539. See References. References Microsoft Knowledge Base Article Q177539 Windows 95 Stops Responding Because of Land Attack http://support.microsoft.com/support/kb/articles/q177/5/39.asp Microsoft Market Bulletin Microsoft Windows NT and Windows 95 - TCP/IP Denial of Service - 'LAND' Program http://www.microsoft.com/windows/platform/info/land.htm Microsoft Knowledge Base Article Q165005 Windows NT Slows Down Due to Land Attack http://support.microsoft.com/support/kb/articles/q165/0/05.asp Microsoft Product Support Services Windows NT Service Packs http://support.microsoft.com/support/ntserver/Content/ServicePacks/ ISS X-Force VTCP.386 is out of date http://xforce.iss.net/static/912.php CVE CVE-1999-0016 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0016 Account policy was changed (Account_policy_change) About this signature or vulnerability This signature detects that an account policy has been changed. Default risk level Medium 7 Security identifier failed to be written to Windows 2000 security principal sIDHistory (Add_SID_failure) Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Unix, Windows NT Type Host Sensor Vulnerability description In Windows NT/2000 and Solaris, the account policy files control policies that govern the strength of user passwords and how often a user can fail at logging in before being locked out of a system. Account policies are also the first level of control that encourage users to follow good password practices. An attacker who has gained access to a system may attempt to change policy settings to allow for weaker passwords. Windows NT/2000: Windows NT/2000 systems include a series of controls that help control how all users access a system. These controls determine how passwords must be used by all user accounts and whether user accounts are automatically locked out after a series of incorrect logon attempts. This includes controls on password age and length. Collectively, these controls are referred to as the "Account policy" and can be set from within the User Manager utility. Solaris: Solaris can require passwords to be of a minimum or maximum length and can give passwords a minimum and maximum number of weeks to remain valid. These controls are contained in the file /etc/default/passwd. Collectively, these controls are sometimes referred to as the account policy. How to remove this vulnerability Take notice of changes to the account policy. Changes in the account policy apply to all users and are only done infrequently. If legitimate administrative work cannot account for the event, then further investigation is needed. References ISS X-Force Account policy was changed http://xforce.iss.net/static/1574.php Security identifier failed to be written to Windows 2000 security principal sIDHistory (Add_SID_failure) About this signature or vulnerability This signature detects a Windows event log message indicating that a Security ID (SID) failed to be added to a security principal’s sIDHistory. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Unix, Windows NT, Windows 2000 Type Host Sensor 8 Security identifier added to Windows 2000 security principal sIDHistory (Add_SID_success) Vulnerability description Adding SIDs (Security Identifiers) to a security principal's sIDHistory is a securitysensitive operation that can grant the target security principal access to all resources that are accessible to the source security principal. The sIDHistory is used by Active Directory security principals to store previous SIDs of moved objects such as users and security groups. If an SID is added to the sIDHistory of an unauthorized security principal, it could indicate an attempt by an attacker to gain privileges on the Windows 2000 domain. Events indicating the failure of such an operation are equally suspicious. How to remove this vulnerability Verify that the sIDHistory operation was authorized. References ISS X-Force Security identifier failed to be written to Windows 2000 security principal sIDHistory http://xforce.iss.net/static/4863.php Security identifier added to Windows 2000 security principal sIDHistory (Add_SID_success) About this signature or vulnerability This signature detects a Windows event log message indicating that a Security ID (SID) has been successfully added to a security principal’s sIDHistory. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Unix, Windows NT, Windows 2000 Type Host Sensor Vulnerability description Adding SIDs (Security Identifiers) to a security principal's sIDHistory is a securitysensitive operation that can grant the target security principal access to all resources that are accessible to the source security principal. The sIDHistory is used by Active Directory security principals to store previous SIDs of moved objects such as users and security groups. If an SID is added to the sIDHistory of an unauthorized security principal, it could indicate an attempt by an attacker to gain privileges on the Windows 2000 domain. How to remove this vulnerability Verify that the sIDHistory operation was authorized. References ISS X-Force Security identifier added to Windows 2000 security principal sIDHistory http://xforce.iss.net/static/4862.php 9 RPC admind insecure authentication (Admind) RPC admind insecure authentication (Admind) About this signature or vulnerability This signature detects that the rpc.admind daemon is being used with insecure authentication. False positives RealSecure Network Sensor: It is possible that normal operation of the Solstice Administration Suite can trigger this signature. Examine the source address of the computer that triggered this event. An unknown or inappropriate device could indicate an attack. RealSecure Server Sensor: It is possible that normal operation of the Solstice Administration Suite can trigger this signature. Examine the source address of the computer that triggered this event. An unknown or inappropriate device could indicate an attack. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 6.5 Systems affected Solaris Type Unauthorized Access Attempt Vulnerability description The rpc.admind daemon is used for remote administration of Solaris computers. If rpc.admind is used with insecure authentication, a remote attacker could compromise the computer, allowing the attacker to add user accounts. This relatively complex attack may indicate the presence of a sophisticated attacker. How to remove this vulnerability Examine the source address of the rpc.admind daemon to determine if this event is coming from a non-admin computer. If this is not from an authorized computer, you should consider the system compromised and take appropriate action. To protect your system from future attacks: References ● Edit the /etc/inetd.conf file, ensuring that rpc.admind is started with the "-s 2" argument. ● Restart the inetd process. ISS X-Force RPC admind insecure authentication http://xforce.iss.net/static/626.php CVE CAN-1999-0568 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0568 10 IBM C Set ++ pdnsd for AIX contains a remotely exploitable buffer overflow (AIX_Pdnsd_BO) IBM C Set ++ pdnsd for AIX contains a remotely exploitable buffer overflow (AIX_Pdnsd_BO) About this signature or vulnerability This signature detects a large string of data being sent to pdnsd on TCP port 4242, indicating a potential buffer overflow. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected AIX: 3.1, AIX: 3.2, AIX: 3.2.4, AIX: 3.2.5, AIX: 2.2.1 Type Unauthorized Access Attempt Vulnerability description The Source Code Browser's Program Database Name Server Daemon (pdnsd) component of the C Set ++ compiler for AIX contains a remotely exploitable buffer overflow. This vulnerability could allow local or remote attackers to compromise root privileges on vulnerable systems. How to remove this vulnerability The C Set ++ compiler is no longer a supported product of IBM. Users are encouraged to disable the pdnsd daemon on affected hosts by executing the following commands as root: 1. rmitab browser 2. chown root.system /usr/lpp/xlC/browser/pdnsd 3. chmod 0 /usr/lpp/xlC/browser/pdnsd 4. /usr/lpp/xlC/browser/pdnsdkill References IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1999:003.1 The IBM C Set ++ for AIX Source Code Browser allows local and remote users to become root. http://www-1.ibm.com/services/continuity/recover1.nsf/advisories/ 8FE7BF46758BA6ED8525680F0077E4EE/$file/sva003.txt CIAC Information Bulletin J-059 IBM AIX (pdnsd) Buffer Overflow Vulnerability http://www.ciac.org/ciac/bulletins/j-059.shtml ISS X-Force IBM C Set ++ pdnsd for AIX contains a remotely exploitable buffer overflow http://xforce.iss.net/static/3135.php CVE CVE-1999-0745 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0745 11 Allaire JRun Server JSP files could be executed as JSP scripts on the server (Allaire_JRun_JSP_Execute) Allaire JRun Server JSP files could be executed as JSP scripts on the server (Allaire_JRun_JSP_Execute) About this signature or vulnerability This signature detects an HTTP GET request that could execute arbitrary JSP (Java Server Page) code on an Allaire JRun server. RealSecure is configured to detect HTTP GET requests to an Allaire JRun server on TCP port 8000, the default port for Allaire JRun server. If you run Allaire JRun server on a port other than 8000, you can configure this port in the RealSecure policy editor, under the service name Allaire JRun. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected JRun: 2.3.x Type Unauthorized Access Attempt Vulnerability description Allaire JRun version 2.3x could be used to execute arbitrary code on the Web server, due to a vulnerability in the way Java Server Pages (JSP files) are executed. JRun is used to develop Web applications with JSP and Java Servlets. A remote attacker could insert executable code in the form of JSP tags into any file on the Web server, then force this file to be compiled and executed as a JSP file. An attacker can send a specially-crafted URL containing the /servlet/ prefix and "dot dot" (../) sequences to traverse directories and execute files on the Web server. It may be possible for an attacker to use this vulnerability to gain administrative privileges on the system. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Allaire Security Bulletin ASB0029. See References. References Allaire Security Bulletin ASB00-29 JRun 2.3.3: Patch available for "JSP execution of arbitrary file" security issue http://www.allaire.com/handlers/index.cfm?ID=17969 Foundstone Security Advisory FS-102300-14-JRUN Remote command execution http://www.foundstone.com/cgi-bin/display.cgi?Content_ID=229 ISS X-Force Allaire JRun Server JSP files could be executed as JSP scripts on the server http://xforce.iss.net/static/5406.php CVE CAN-2000-1053 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1053 12 Allaire JRun 2.3.x sample files allow remote access (Allaire_JRun_Sample_Files) Allaire JRun 2.3.x sample files allow remote access (Allaire_JRun_Sample_Files) About this signature or vulnerability Enter the JRun Admin Server port: Internet Scanner checks port 8000 for vulnerable versions of Allaire JRun that could allow a remote user to view files on the Web server. Enter the sample file: Internet Scanner checks this directory (/servlet/SessionServlet) to determine whether a remote attacker can view sample files, online documentation, or any files containing sensitive information. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected JRun: 2.3.x Type Unauthorized Access Attempt Vulnerability description Allaire JRun is a Java application server that supports Java Servlet APIs and Java Server Pages (JSP). JRun 2.3.x includes sample files that could allow a remote user to view files on the Web server. By requesting specially crafted URLs, a remote attacker could read online documentation or sample files, as well as other files on the Web server. An attacker could use this vulnerability to retrieve sensitive information. How to remove this vulnerability Apply Allaire JRun 2.3.3 Maintenance Patch Build 158, available from the Allaire Web site. See References. — AND — Remove all sample code, example applications, tutorials and documentation from production servers. JRun 2.3.x examples are installed in the JRUN_HOME/servlets directory and the JRUN_HOME/jsm-default/services/jws/htdocs directory. Remove all files placed in these directories by the JRun installation. As a rule, sample code and example applications should not be installed on production servers. References Allaire Security Bulletin ASB00-15 Workaround available for vulnerabilities exposed by JRun 2.3.x code sample http://www.allaire.com/handlers/index.cfm?ID=16290 Allaire Corporation Web Site Allaire Download System http://www.allaire.com/download/ ISS X-Force Allaire JRun 2.3.x sample files allow remote access http://xforce.iss.net/static/4774.php 13 Allaire JRun Server SSIFilter with malformed URL could be used to access files (Allaire_JRun_SSIFilter) CVE CVE-2000-0540 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0540 Allaire JRun Server SSIFilter with malformed URL could be used to access files (Allaire_JRun_SSIFilter) About this signature or vulnerability This signature detects an HTTP GET request that could retrieve arbitrary files outside the root directory of an Allaire JRun server. RealSecure is configured to detect HTTP GET requests to an Allaire JRun server on TCP port 8000, the default port for Allaire JRun server. If you run Allaire JRun server on a port other than 8000, you can configure this port in the RealSecure policy editor, under the service name Allaire JRun. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected JRun: 2.3.x Type Unauthorized Access Attempt Vulnerability description Allaire JRun version 2.3x could allow a remote attacker to retrieve unauthorized files from the Web server, due to a vulnerability in the way Java Server Pages (JSP files) are executed. JRun is used to develop Web applications with JSP and Java Servlets. The JRun server fails to properly check for "dot dot" (../) sequences in URLs. By using the JRun server's SSIFilter, a remote attacker can send a specially-crafted URL that contains "dot dot" (../) sequences to traverse directories and access any file on the server. An attacker could also use this to access the source code of arbitrary files in the server's document root. Potentially proprietary Web server files (such as Java Server Pages) may contain sensitive information (such as user IDs and passwords) embedded in the source code. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Allaire Security Bulletin ASB0028. See References. References Allaire Security Bulletin ASB00-28 JRun 2.3.3: Patch available for "non-webroot requests" security issue http://www.allaire.com/handlers/index.cfm?ID=17968 Foundstone Security Advisory FS-102300-13-JRUN Arbitrary File Retrieval http://www.foundstone.com/cgi-bin/display.cgi?Content_ID=230 ISS X-Force Allaire JRun Server SSIFilter with malformed URL could be used to access files http://xforce.iss.net/static/5405.php 14 Allaire JRun Server could allow unauthorized access to WEB-INF directory (Allaire_JRun_WebInf_SlashSlash) CVE CAN-2000-1052 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1052 Allaire JRun allows file access using malformed WEB-INF directory request (Allaire_JRun_WebInf_DotSlash) About this signature or vulnerability This signature detects an HTTP GET request for the WEB-INF directory preceded with a dot slash character sequence ("/./"). This GET request could indicate an attempt by a remote user to obtain the contents of this otherwise restricted directory. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2, RealSecure Server Sensor: 6.5 Systems affected JRun: 3.0 Type Unauthorized Access Attempt Vulnerability description Allaire JRun Web Server version 3.0 could allow a remote attacker to obtain directory listings and retrieve file contents from the WEB-INF directory. A remote attacker can submit a specially-crafted URL containing "/./WEB-INF/" to obtain a directory listing and view files from the WEB-INF directory. How to remove this vulnerability Apply the latest Service Pack for JRun 3.0 (SP2 or later), as listed in Allaire Security Bulletin ASB01-02. See References. References Allaire Security Bulletin ASB01-02 JRun 3.0: Patch available for JRun malformed URI WEB-INF directory information and web.xml file retrieval issue http://www.allaire.com/handlers/index.cfm?ID=19546&Method=Full ISS X-Force Allaire JRun allows file access using malformed WEB-INF directory request http://xforce.iss.net/static/6008.php CVE CVE-2001-0179 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0179 Allaire JRun Server could allow unauthorized access to WEBINF directory (Allaire_JRun_WebInf_SlashSlash) About this signature or vulnerability This signature detects an HTTP GET request for the WEB-INF directory preceded with two slash ('/') characters. This GET request could indicate an attempt by a remote user to obtain the contents of this otherwise restricted directory. 15 Automounter daemon buffer overflow can lead to remote root access (Amd_Overflow) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected JRun: 3.0 Type Unauthorized Access Attempt Vulnerability description Allaire JRun version 3.0 and version 3.0 with SP1 could allow unauthenticated read access to the WEB-INF directory. JRun is used to develop Web applications with Java Server Pages (JSP files) and Java Servlets. The WEB-INF directory contains information on precompiled JSP files, Web application classes, server side libraries, session information, and sensitive files (including web.xml and webapp.properties). A remote attacker could request the WEB-INF directory using a specially-crafted URL with an additional slash (/) to view the contents of the WEB-INF directory and reveal all of its subdirectories. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Allaire Security Bulletin ASB0027. See References. References Allaire Security Bulletin ASB00-27 JRun 3.0: Patch available for 'extra leading slash' security issue http://www.allaire.com/handlers/index.cfm?ID=17966 Foundstone Security Advisory FS-102300-12-JRUN Unauthenticated Access to WEB-INF directory http://www.foundstone.com/cgi-bin/display.cgi?Content_ID=231 ISS X-Force Allaire JRun Server could allow unauthorized access to WEB-INF directory http://xforce.iss.net/static/5407.php CVE CAN-2000-1050 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1050 Automounter daemon buffer overflow can lead to remote root access (Amd_Overflow) About this signature or vulnerability This signature detects a long query directed at the amd service. Legitimate amd queries are usually very small. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 1.3 16 Automounter daemon buffer overflow can lead to remote root access (Amd_Overflow) Systems affected FreeBSD, Red Hat Linux: 4.2, Caldera OpenLinux, Debian Linux, Red Hat Linux: 5.2, Red Hat Linux: 6.0, BSD/OS: 4.0.1, BSD/OS: 3.1, BSD/OS: 4.0 Type Unauthorized Access Attempt Vulnerability description The Automounter daemon (amd) is vulnerable to a buffer overflow in the mount code that affects Linux and some BSD platforms. The amd daemon responds to attempts to access files by automatically mounting file systems on which those files reside. By passing a long string to the AMQPROC_MOUNT procedure, a remote attacker can overflow the buffer and gain root privileges on the system. How to remove this vulnerability Upgrade to the latest version of amd-utils (6.0.1 or later), as listed in CERT Advisory CA1999-12. See References. As a workaround, disable the amd daemon. However, this may prevent your system from operating normally. For Red Hat Linux 6.0: Upgrade to the latest version of am-utils (6.01S11-1 or later), as listed in Red Hat, Inc. Security Advisory RHSA-1999:032-01. See References. For Caldera OpenLinux 2.2: Upgrade to the latest version of am-utils (6.0-7 or later), as listed in Caldera Systems, Inc. Security Advisory CSSA-1999:024.0. See References. For BSDI (BSD/OS 4.0.1 and 3.1): Apply the mods M410-017 for 4.0.1 and M310-057 patch, as listed in CERT Advisory CA99-12. See References. For FreeBSD: Upgrade to the latest version of FreeBSD (3.3-RELEASE or later), as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-99:06. See References. — OR — Apply the patch for this vulnerability, as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-99:06. See References. For Debian Linux 2.1: Upgrade to the latest version of amd (upl102-23.slink2 or later), as listed in Debian Security Advisory 19991018a. See References. For other distributions: Contact your vendor for upgrade or patch information. Red Hat Linux: 4.2 The am-utils package based on code base shipped with many Linux distributions has been updated am-utils at ftp://shekel.mcl.cs.columbia.edu/pub/am-utils/ Caldera OpenLinux The am-utils package based on code base shipped with many Linux distributions has been updated am-utils at ftp://shekel.mcl.cs.columbia.edu/pub/am-utils/ 17 Automounter daemon can be remotely queried for its process ID (Amd_Pid) Red Hat Linux: 5.2 The am-utils package based on code base shipped with many Linux distributions has been updated am-utils at ftp://shekel.mcl.cs.columbia.edu/pub/am-utils/ Red Hat Linux: 6.0 The am-utils package based on code base shipped with many Linux distributions has been updated am-utils at ftp://shekel.mcl.cs.columbia.edu/pub/am-utils/ References Red Hat Linux Errata Advisory RHSA-1999:032-01 Buffer overrun in amd http://www.redhat.com/support/errata/RHSA1999032_O1.html Caldera Systems, Inc. Security Advisory CSSA-1999-024.0 buffer overflow in amd http://www.calderasystems.com/support/security/advisories/CSSA-1999-024.0.txt CERT Advisory CA-1999-12 Buffer Overflow in amd http://www.cert.org/advisories/CA-1999-12.html BSDI Internet Super Server 4.0.1 Mods (patches) BSDI Mod M401-017 http://www.bsdi.com/services/support/patches/patches-4.0.1/ FreeBSD, Inc. Security Advisory FreeBSD-SA-99:06 (from SecurityFocus Archive) remote amd attack http://www.securityfocus.com/advisories/1786 CIAC Information Bulletin J-071 Buffer Overflow Vulnerability in amd http://www.ciac.org/ciac/bulletins/j-071.shtml Debian Security Advisory 19991018a amd: Buffer overflow in amd -- update http://www.debian.org/security/1999/19991018a ISS X-Force Automounter daemon buffer overflow can lead to remote root access http://xforce.iss.net/static/3171.php CVE CVE-1999-0704 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0704 Automounter daemon can be remotely queried for its process ID (Amd_Pid) About this signature or vulnerability 18 This signature detects a query to the amd service for program ID (PID) information. Automounter daemon can be remotely queried for its process ID (Amd_Pid) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3 Systems affected Unix Type Suspicious Activity Vulnerability description The Automounter daemon (amd) on some systems allows a remote user to query the service for its current process ID (PID). By obtaining the PID of other processes, an attacker can determine the randomness of the PIDs used on the system. Predictable PIDs can be useful to an attacker for some kinds of attacks. PID information should not be provided to untrusted users. How to remove this vulnerability Block traffic to the RPC portmapper and the ports used by the automounter service at your border gateway(s), firewall(s), or a combination of both. — AND — Upgrade to the latest version of amd-utils (6.0.1 or later), as listed in CERT Advisory CA1999-12. See References. For Red Hat Linux 6.0: Upgrade to the latest version of am-utils (6.01S11-1 or later), as listed in Red Hat, Inc. Security Advisory RHSA-1999:032-01. See References. For Caldera OpenLinux 2.2: Upgrade to the latest version of am-utils (6.0-7 or later), as listed in Caldera Systems, Inc. Security Advisory CSSA-1999:024.0. See References. For BSDI (BSD/OS 4.0.1 and 3.1): Apply the mods M410-017 for 4.0.1 and M310-057 patch, as listed in CERT Advisory CA1999-12. See References. For FreeBSD: Upgrade to the latest version of FreeBSD (3.3 Release or later), as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-99:06. See References. — OR — Apply the patch for this vulnerability, as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-99:06. See References. For Debian Linux: Upgrade to the latest version of amd (up1102-23.slink2 or later), as listed in Debian Security Advisory 19991018a. See References. For other distributions: Contact your vendor for upgrade or patch information. 19 Automounter daemon allows users to remotely query for system information (Amd_Version) References Red Hat Linux Errata Advisory RHSA-1999:032-01 Buffer overrun in amd http://www.redhat.com/support/errata/RHSA1999032_O1.html Caldera Systems, Inc. Security Advisory CSSA-1999-024.0 buffer overflow in amd http://www.calderasystems.com/support/security/advisories/CSSA-1999-024.0.txt CERT Advisory CA-1999-12 Buffer Overflow in amd http://www.cert.org/advisories/CA-1999-12.html BSDI Internet Super Server 4.0.1 Mods (patches) BSDI Mod M401-017 http://www.bsdi.com/services/support/patches/patches-4.0.1/ FreeBSD, Inc. Security Advisory FreeBSD-SA-99:06 remote amd attack ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-99:06.amd.asc CIAC Information Bulletin J-071 Buffer Overflow Vulnerability in amd http://www.ciac.org/ciac/bulletins/j-071.shtml Debian Security Advisory 19991018a amd: Buffer overflow in amd -- update http://www.debian.org/security/1999/19991018a ISS X-Force Automounter daemon can be remotely queried for its process ID http://xforce.iss.net/static/3232.php Automounter daemon allows users to remotely query for system information (Amd_Version) About this signature or vulnerability This signature detects a query to the amd service for version information. False positives RealSecure Network Sensor: Although highly unlikely, a false positive is possible if a legitimate user queries his or her own amd server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3 Systems affected Unix Type Pre-attack Probe 20 Automounter daemon allows users to remotely query for system information (Amd_Version) Vulnerability description The Automounter daemon (amd) allows a remote user to query the service for information about the system, including what operating system is in use, who built it, and when it was built. This information could be useful to an attacker in performing an attack. How to remove this vulnerability Block traffic to the RPC portmapper and the ports used by the automounter service at your border gateway(s), firewall(s), or a combination of both. — AND — Upgrade to the latest version of amd-utils (6.0.1 or later), as listed in CERT Advisory CA1999-12. See References. For Red Hat Linux 6.0: Upgrade to the latest version of am-utils (6.01S11-1.6.0 or later), as listed in Red Hat, Inc. Security Advisory RHSA-1999:032-01. See References. For Caldera OpenLinux 2.2: Upgrade to the latest version of am-utils (6.0-7 or later), as listed in Caldera Systems, Inc. Security Advisory CSSA-1999:024.0. See References. For BSDI (BSD/OS 4.0.1 and 3.1): Apply the mods M410-017 for 4.0.1 and M310-057 patch, as listed in CERT Advisory CA99-12. See References. For FreeBSD: Upgrade to the latest version of FreeBSD (3.3 RELEASE or later), as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-99:06. See References. — OR — Apply the patch for this vulnerability, as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-99:06. See References. For Debian Linux: Upgrade to the latest version of amd (up1102-23.slink2 or later), as listed in Debian Security Advisory 19991018a. See References. For other distributions: Contact your vendor for upgrade or patch information. References Red Hat Linux Errata Advisory RHSA-1999:032-01 Buffer overrun in amd http://www.redhat.com/support/errata/RHSA1999032_O1.html Caldera Systems, Inc. Security Advisory CSSA-1999-024.0 buffer overflow in amd http://www.calderasystems.com/support/security/advisories/CSSA-1999-024.0.txt CERT Advisory CA-1999-12 Buffer Overflow in amd http://www.cert.org/advisories/CA-1999-12.html 21 Solaris AnswerBook2 administration interface (AnswerBook2_Admin) BSDI Internet Super Server 4.0.1 Mods (patches) BSDI Mod M401-017 http://www.bsdi.com/services/support/patches/patches-4.0.1/ FreeBSD, Inc. Security Advisory FreeBSD-SA-99:06 remote amd attack ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-99:06.amd.asc CIAC Information Bulletin J-071 Buffer Overflow Vulnerability in amd http://www.ciac.org/ciac/bulletins/j-071.shtml Debian Security Advisory 19991018a amd: Buffer overflow in amd -- update http://www.debian.org/security/1999/19991018a ISS X-Force Automounter daemon allows users to remotely query for system information http://xforce.iss.net/static/3236.php Solaris AnswerBook2 administration interface (AnswerBook2_Admin) About this signature or vulnerability This signature detects an HTTP GET request to a Solaris AnswerBook2 server, which is attempting to add an administrative user. Some versions of the AnswerBook2 HTTP server fail to require authentication to add new users to the service, which could allow unauthorized access to the system. RealSecure is configured to detect HTTP GET requests to a Solaris AnswerBook2 server on TCP port 8888, the default port for Solaris AnswerBook2. If you run AnswerBook2 server on a port other than 8888, you can configure this port in the RealSecure policy editor, under the service name AnswerBook2. False positives RealSecure Network Sensor: It is possible that this signature may detect an authorized adminsitrator adding a user to the AnswerBook2 server. Check the source and destination addresses to verify that this is an authorized action. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected Answerbook2 Type Unauthorized Access Attempt Vulnerability description Sun Solaris AnswerBook2 versions 1.3x, 1.4, 1.4.1, and 1.4.2 could allow an unauthorized user to access the administration interface. Due to improper authentication checking on specific CGI scripts, an unauthorized user could create a new user by passing values to 22 Solaris AnswerBook2 Web interface could allow remote execution (AnswerBook2_Execute) the CGI without being authenticated. An unauthorized user could use this to read files and gain control over content. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Sun Microsystems, Inc. Security Bulletin #00196. See References. References BugTraq Mailing List, Mon Aug 07 2000 21:01:11 Vulnerabilities in Sun Solaris AnswerBook2 dwhttpd server http://www.securityfocus.com/archive/1/74382 Sun Microsystems, Inc. Security Bulletin #00196 AnswerBook2 http://www.securityfocus.com/advisories/2486 CIAC Information Bulletin L-031 Sun AnswerBook2 Vulnerability http://www.ciac.org/ciac/bulletins/l-031.shtml ISS X-Force Solaris AnswerBook2 administration interface http://xforce.iss.net/static/5069.php CVE CAN-2000-0696 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0696 Solaris AnswerBook2 Web interface could allow remote execution (AnswerBook2_Execute) About this signature or vulnerability This signature detects a specially formatted HTTP GET request to a Solaris AnswerBook2 server. This GET request could execute the "reset_error_log" command with a file argument containing a shell metacharacter or a dot dot ("../") character sequence. This GET request indicates an attempt to manipulate files or execute arbitrary commands on the AnswerBook2 server. RealSecure is configured to detect HTTP GET requests to a Solaris AnswerBook2 server on TCP port 8888, the default port for Solaris AnswerBook2. If you run AnswerBook2 server on a port other than 8888, you can configure this port in the RealSecure policy editor, under the service name AnswerBook2. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected Answerbook2 Type Unauthorized Access Attempt 23 L0pht AntiSniff ARP test detected (AntiSniff_ARP_Test) Vulnerability description Solaris AnswerBook2 ships with an HTTP server that allows users to access Solaris documentation using a Web browser. Due to a vulnerability in the HTTP server (dwhttpd), a remote attacker can access the administration interface of AnswerBook2 and execute arbitrary commands on the remote host with the privileges of the Web server. The Web server usually runs as user daemon. How to remove this vulnerability Upgrade to the latest version of AnswerBook2 (1.4.2 or later), and then apply the appropriate patch for your system, as listed in Sun Microsystems, Inc. Security Bulletin #00196. See References. References BugTraq Mailing List, Mon Aug 07 2000 14:01:11 Vulnerabilities in Sun Solaris AnswerBook2 dwhttpd server http://www.securityfocus.com/archive/1/74382 Sun Microsystems, Inc. Security Bulletin #00196 AnswerBook2 http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=secbull/196 CIAC Information Bulletin L-031 Sun AnswerBook2 Vulnerability http://www.ciac.org/ciac/bulletins/l-031.shtml ISS X-Force Solaris AnswerBook2 Web interface could allow remote execution http://xforce.iss.net/static/5058.php CVE CAN-2000-0697 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0697 L0pht AntiSniff ARP test detected (AntiSniff_ARP_Test) About this signature or vulnerability This signature detects the L0pht AntiSniff program performing an ARP test to scan your network for systems in promiscuous (sniffing) mode. False positives RealSecure Network Sensor: A false positive is possible if RealSecure detects a packet from a similar tool that is not AntiSniff. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Any Type Pre-attack Probe Vulnerability description The L0pht AntiSniff program is performing an ARP test to scan your network for systems in promiscuous (sniffing) mode. 24 L0pht AntiSniff DNS test detected (AntiSniff_DNS_Test) The AntiSniff program developed by L0pht Heavy Industries determines if a device is listening to traffic on the local network. An attacker could use L0pht AntiSniff to gain information about a network that could be useful in an attack. AntiSniff can detect if an IDS (Intrusion Detection System) is being used on the network, prompting an attacker to use IDS evasion techniques. An attacker could also use L0pht AntiSniff to locate a compromised system that has been placed in promiscuous (sniffing) mode that could be used by the attacker. How to remove this vulnerability This occurrence may identify a local attacker on your network, because the AntiSniff ARP test can only be performed on a local LAN, not across the Internet. Determine which computer is using L0pht AntiSniff, and determine if it is in compliance with your system policies. References @stake, Inc./L0pht Heavy Industries, Inc. Web site AntiSniff http://www.l0pht.com/antisniff/ ISS X-Force L0pht AntiSniff ARP test detected http://xforce.iss.net/static/4653.php L0pht AntiSniff DNS test detected (AntiSniff_DNS_Test) About this signature or vulnerability This signature detects the L0pht AntiSniff program performing a DNS test to scan your network for systems in promiscuous (sniffing) mode. False positives RealSecure Network Sensor: A false positive is possible if RealSecure detects a packet from a similar tool that is not AntiSniff. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Any Type Pre-attack Probe Vulnerability description The L0pht AntiSniff program is performing a DNS test to scan your network for systems in promiscuous (sniffing) mode. The AntiSniff program developed by L0pht Heavy Industries determines if a device is listening to traffic on the local network. An attacker could use L0pht AntiSniff to gain information about a network that could be useful in an attack. AntiSniff can detect if an IDS (Intrusion Detection System) is being used on the network, prompting an attacker to use IDS evasion techniques. An attacker could also use L0pht AntiSniff to locate a compromised system that has been placed in promiscuous (sniffing) mode that could be used by the attacker. 25 AOL Admin backdoor for Windows and AOL (AolAdmin) How to remove this vulnerability This occurrence may identify a local attacker on your network, because the AntiSniff DNS test can only be performed on a local LAN, not across the Internet. Determine which computer is using L0pht AntiSniff, and determine if it is in compliance with your system policies. References @stake, Inc./L0pht Heavy Industries, Inc. Web site AntiSniff http://www.l0pht.com/antisniff/ ISS X-Force L0pht AntiSniff DNS test detected http://xforce.iss.net/static/4661.php AOL Admin backdoor for Windows and AOL (AolAdmin) About this signature or vulnerability This signature detects a TCP connection on port 30029 to an AOL Admin backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The AOL Admin backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the AOL Admin backdoor, an attacker can do the following: How to remove this vulnerability ● execute programs ● delete files ● send Instant Messages to an AOL user ● monitor Instant Messages that you receive ● send email from your AOL account To remove AOL Admin from your computer: 1. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. 2. Find the registry entry that is named dat92003 and has a data value of dat92003.exe. 3. Delete this registry entry. 4. Delete dat92003.exe from your Windows system directory. 26 ARP host down detection (Arp) References PestControl Web site AOL Admin http://safersite.com/PestInfo/A/AOL_Admin.asp ISS X-Force AOL Admin backdoor for Windows and AOL http://xforce.iss.net/static/3131.php ARP host down detection (Arp) About this signature or vulnerability This signature detects a series of ARP requests with no corresponding replies. This condition could indicate that a host on the network has crashed or has stopped responding to network traffic. False positives RealSecure Network Sensor: A false positive is possible if RealSecure is monitoring a network segment that is using Layer 2 bridging or switching. False positives may occur when both systems involved are across a bridge or switch from the sensor. This is because the bridging/switching causes the sensor to see the ARP requests (which are broadcasts) but to miss the ARP replies (which are unicast packets). Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Any Type Suspicious Activity Vulnerability description On Ethernet segments, hosts periodically send Address Resolution Protocol (ARP) queries to other computers on the network to translate between IP and Ethernet MAC addresses. During normal operation of a computer, a host will respond to these queries with an ARP reply. If a host has crashed or otherwise stopped responding to network traffic, ARP queries will accumulate on the network with no corresponding ARP replies being returned. By examining the relationship between an ARP query and a lack of ARP replies, it is possible to passively determine if a host on a network is non-responsive. If a computer is not responding to ARP requests, it may have crashed, or it may be the victim of a denial of service attack. How to remove this vulnerability No remedy available as of June 2001. References ISS X-Force ARP host down detection http://xforce.iss.net/static/395.php 27 Ascend and 3Com router malformed TCP packet denial of service (Ascend_Kill) Ascend and 3Com router malformed TCP packet denial of service (Ascend_Kill) About this signature or vulnerability This signature detects malformed TCP packets that an attacker could use to cause internal errors on Ascend routers that use certain versions of the Ascend operating system. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Ascend Routers: R 4.5Ci12and earlie Type Denial of Service Vulnerability description Ascend routers that use certain versions of the Ascend operating system and some 3Com routers are vulnerable to a denial of service attack. An attacker could send a malformed TCP packet to an Ascend router to cause an internal error on the router; this internal error will cause the router to restart. This attack can disconnect you from the Internet or disconnect remote users from your site. The router may not automatically restart, in which case the router must be restarted in order to restore normal functionality. How to remove this vulnerability Ping the router that received the attack to determine if it is still active. Restart the router if it is not active. — AND — Upgrade the Ascend router to Release 4.5Ci12 or later. Contact Lucent Technologies for upgrade information. References BugTraq Mailing List, Sat Nov 16 1996 10:53:33 El Programa Matador de Ascendes http://www.securityfocus.com/archive/1/5682 BugTraq Mailing List, Wed Oct 30 1996 03:44:20 Someone reminded me of something today ;) http://www.securityfocus.com/archive/1/5640 BugTraq Mailing List, Wed Oct 30 1996 22:10:38 Re: BoS: Someone reminded me of something today ;) http://www.securityfocus.com/archive/1/5647 ISS X-Force Ascend and 3Com router malformed TCP packet denial of service http://xforce.iss.net/static/614.php CVE CAN-1999-0193 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0193 28 Asylum RAT (Remote Access Tool) backdoor for Windows (Asylum) Asylum RAT (Remote Access Tool) backdoor for Windows (Asylum) About this signature or vulnerability This signature detects a TCP connection to an Asylum backdoor on port 23432 on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows NT, Windows 95, Windows 98, Windows 2000 Type Unauthorized Access Attempt Vulnerability description The Asylum remote administration tool (RAT) is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Asylum backdoor, an attacker can upload and execute files on the host and restart the computer. Asylum is distributed with an "edit server" program that allows the attacker to customize the backdoor server to run on arbitrary ports (TCP 23432 by default) and use combinations of startup methods, making it difficult to remove from an infected host. How to remove this vulnerability To remove a default installation of Asylum from your computer: 1. Open C:\Windows\System.ini and remove the entry for wincmp32.exe in the shell key under the [boot] section. 2. Restart your computer. 3. Delete C:\Windows\wincmp32.exe. The Asylum backdoor can be difficult to remove manually, because it is configurable, making it difficult to identify on your system. If the above instructions do not remove the Asylum backdoor, refer to the steps below for using an anitvirus program to remove the backdoor. To use an antivirus program to remove the Asylum backdoor: 1. If you do not have an antivirus program installed, download and install one of these virus scanners: ■ Norton AntiVirus: http://www.symantec.com/nav/indexA.html ■ McAfee VirusScan: http://software.mcafee.com/centers/download/ ■ Trend Micro PC-Cillin: http://www.trend.com/pc-cillin/ 2. Run the antivirus program to scan your system for this backdoor. The virus scanner should find and remove the Asylum backdoor from your computer. References [sd] inc. Web site Asylum http://asylum.slak.org/index2.html 29 Audit policy settings changed manually (Audit_policy_change) ISS X-Force Asylum RAT (Remote Access Tool) backdoor for Windows http:// xforce.iss.net/static/4849.php Audit log manually cleared by a user with appropriate privileges (Audit_log_cleared) About this signature or vulnerability This signature detects that the Windows NT audit log has been manually cleared by a user with appropriate privileges. Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Unix, Windows NT Type Host Sensor Vulnerability description The Windows NT system records event records in the audit log, which is the principal record of activity on the system. The audit log records events according to the audit policies that have been set by the system administrator. A user with appropriate privileges may clear the log, which deletes all records from the log. When a log is cleared, Windows NT writes an event message to the log indicating that fact. Audit logs are not typically cleared manually. Using the "log settings" option in the Event Viewer utility, an administrator can control the size of the log and when records are removed from the log. An attacker that has gained access to a system may attempt to erase indications of his activities by deleting all records from the security audit log. How to remove this vulnerability Any instance of manually clearing the security audit log should be investigated. If legitimate administrative work cannot account for the event, then further investigation is needed. Investigate any recently recorded events. References ISS X-Force Audit log manually cleared by a user with appropriate privileges http://xforce.iss.net/static/1576.php Audit policy settings changed manually (Audit_policy_change) About this signature or vulnerability This signature detects an attempt to manually change a system's audit policy. Normally, the audit policy is automatically set according to the audit functions chosen in the policy setup of RealSecure OS Sensor, and it should not be changed manually. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 30 Authentication package load (Authentication_package_loaded) Systems affected Unix, Windows NT Type Host Sensor Vulnerability description Windows NT/2000 and Solaris use an audit log to record events. The audit log is the principal record of activity on the system and records events according to the audit policies that have been set up by the system administrator. The system's audit policy can be viewed or changed as follows: ● For Windows NT/2000: Access the audit policy details through the User Manager utility. ● For Solaris: The audit policy is contained in the directory /etc/security in the files audit_control, audit_class, and audit_event. The audit policy can be manipulated by using the auditconfig command. How to remove this vulnerability Any instance of changing audit policy should be investigated. If legitimate administrative work cannot account for the event, then further investigation is needed. Ensure that the appropriate audit policy is re-established. References ISS X-Force Audit policy settings changed manually http://xforce.iss.net/static/1578.php Authentication package load (Authentication_package_loaded) About this signature or vulnerability This signature detects a Windows NT/2000 or Solaris system loading a program, called an authentication package, that controls how users are authenticated when they log on to the system. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected Unix, Windows NT Type Host Sensor Vulnerability description Windows NT/2000: The Local Security Authority (LSA) has loaded an authentication package. This authentication package will be used to authenticate any subsequent logon attempts. Typically, the default authentication package (msv1_0.dll) is loaded at system startup. Solaris: Solaris uses PAM, the Pluggable Authentication Module, to provide a number of authentication services. A PAM provides functionality for up to four services: ● authentication: authenticates a user and sets up user credentials ● account management: determines if the user account is valid 31 Authentication ticket granted to a Windows 2000 security principal (Authentication_ticket_granted) ● session management: sets up and terminates login sessions ● password management: provides functionality to change a user's authentication token or password Each of the four service modules can be implemented as a shared library object that can be referenced in the pam.conf configuration file. How to remove this vulnerability Windows NT/2000: This event should not appear under normal usage of Windows NT/ 2000, except at system startup time. If this event appears and the package name is not as expected or if legitimate system administration activities cannot account for this event, examine the authentication package and determine if the correct authentication package should be restored. Solaris: An authentication module is responsible for authenticating a user's access to the system. Changing this package entails making a change to the pam.conf configuration file. This event should not appear as part of the typical use of the system. If this event appears, check the pam.conf file. If the module name is not as expected, or if legitimate system administration activities cannot account for this event, examine the authentication package and determine if the correct authentication package should be restored. References ISS X-Force Authentication package load http://xforce.iss.net/static/2217.php Authentication ticket granted to a Windows 2000 security principal (Authentication_ticket_granted) About this signature or vulnerability This signature detects a Windows event log message indicating that an authentication ticket has been granted. Default risk level Low Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Windows 2000 Type Host Sensor Vulnerability description When a Windows 2000 security principal successfully authenticates with a Windows 2000 domain controller, an authentication ticket is granted to that security principal. The granting of an authentication ticket to a suspicious security principal could indicate an attempt by an attacker to tamper with the Windows 2000 domain. How to remove this vulnerability Verify that the authenticated security principal is authorized. 32 BackConstruction backdoor for Windows (BackConstruction) References ISS X-Force Authentication ticket granted to a Windows 2000 security principal http://xforce.iss.net/static/4864.php Authentication ticket request failed (Authentication_ticket_request_failed) About this signature or vulnerability This signature detects a Windows event log message indicating that an authentication ticket request has failed. Default risk level Low Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Windows 2000 Type Host Sensor Vulnerability description When a Windows 2000 security principal successfully authenticates with a Windows 2000 domain controller, an authentication ticket is granted to that security principal. Frequent failures for an authentication ticket to be granted to a security principal could indicate attempts by an attacker to tamper with the Windows 2000 domain. How to remove this vulnerability Determine the cause of the authentication ticket request failure. References ISS X-Force Authentication ticket request failed http://xforce.iss.net/static/4870.php BackConstruction backdoor for Windows (BackConstruction) About this signature or vulnerability This signature detects a TCP connection on port 5400 or 666 to a BackConstruction backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt 33 Backdoor2 for Windows (BackDoor2) Vulnerability description The BackConstruction backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the BackConstruction backdoor, an attacker can create, retrieve, and manipulate files using a built-in FTP server. How to remove this vulnerability To remove BackConstruction from your computer: 1. Using Regedit, find the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\She ll registry key. 2. Delete this registry key. 3. Delete Cmctl32.exe from the Windows directory. 4. Restart your computer to remove the backdoor from memory. References TL Security Web site TL Security http://tlsecurity.cjb.net/ ISS X-Force BackConstruction backdoor for Windows http://xforce.iss.net/static/3222.php Backdoor2 for Windows (BackDoor2) About this signature or vulnerability This signature detects a TCP connection on port 1999 to a BackDoor2 server on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Backdoor2 backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Backdoor2 backdoor, an attacker can access files and retrieve system information. How to remove this vulnerability To remove Backdoor2 from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating 34 Back Orifice default installation (BackOrifice) system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ registry key. 2. Find the registry entry named Notepad that has a data value of C:\Windows\Notpa.exe /o=yes. 3. Delete this registry entry. 4. Delete Notpa.exe from C:\Windows. References ISS X-Force Backdoor2 for Windows http://xforce.iss.net/static/2389.php Back Orifice default installation (BackOrifice) False negatives RealSecure Network Sensor: No false negatives are known for this signature. RealSecure can detect BackOrifice traffic on all ports, with any password. Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 6.0.1 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Back Orifice backdoor, released by the hacker group Cult of the Dead Cow, is one of many backdoor programs for Windows 95 and Windows 98 that attackers can use to access your computer system without your knowledge or consent. With the Back Orifice backdoor, an attacker can obtain total control of the system. How to remove this vulnerability To remove a default installation of Back Orifice from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunSe rvices registry key. 2. Find and delete the registry entry named (Default) that has a data value of .exe. 3. Restart the computer. 4. Delete the file exe~1 from C:\Windows\System. 35 Back Orifice 2000 allows complete remote administrative control (BackOrifice2000) References Cult of the Dead Cow (cDc) Web site cDc Home Page http://www.cultdeadcow.com Internet Security Systems Security Alert #05 Cult of the Dead Cow Back Orifice Backdoor http://xforce.iss.net/alerts/advise5.php Internet Security Systems Security Alert #08 Windows Backdoors Update http://xforce.iss.net/alerts/advise8.php ISS X-Force Back Orifice default installation http://xforce.iss.net/static/1218.php Back Orifice 2000 allows complete remote administrative control (BackOrifice2000) Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1.2 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description Back Orifice 2000 is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. Back Orifice 2000 allows remote operation of infected Windows 95/98 and Windows NT computers. With the Back Orifice 2000 backdoor, an attacker can do the following: How to remove this vulnerability 36 ● gather information about your network ● perform system commands ● reconfigure computers on your network ● redirect network traffic The Back Orifice 2000 backdoor can be very difficult to remove manually, because it is highly configurable, making it difficult to identify on your system. By default, the Back Orifice 2000 backdoor will install itself in the Windows system directory as the file UMGR32.EXE. On Windows NT, it will install a service listed as "Remote Administration Service." However, this default name can be changed. Refer to the steps below for using an antivirus program to remove the backdoor. BigGluck backdoor for Windows (BigGluck) To use an antivirus program to remove the Back Orifice 2000 backdoor: 1. If you do not have an antivirus program installed, download and install one of these virus scanners: ■ Norton AntiVirus: http://www.symantec.com/nav/indexA.html ■ McAfee VirusScan: http://software.mcafee.com/centers/download/ ■ Trend Micro PC-Cillin: http://www.trend.com/pc-cillin/ 2. Run the antivirus program to scan your system for this backdoor. The virus scanner should find and remove the Back Orifice 2000 backdoor from your computer. References Microsoft Security Bulletin What Customers Should Know About 'BackOrifice 2000' http://www.microsoft.com/security/bulletins/bo2k.asp Cult of the Dead Cow (cDc) Web site Back Orifice 2000 http://www.bo2k.com/indexnews.html Internet Security Systems Security Alert #31 Back Orifice 2000 http://xforce.iss.net/alerts/advise31.php Trend Micro, Inc. Security Alert Back Orifice 2000 http://www.antivirus.com/vinfo/security/sa071299.htm Symantec AntiVirus Research Center BackOrifice2K.Trojan http://www.norton.com/avcenter/venc/data/back.orifice.2000.trojan.html ISS X-Force Back Orifice 2000 allows complete remote administrative control http://xforce.iss.net/static/2343.php BigGluck backdoor for Windows (BigGluck) About this signature or vulnerability This signature detects a telnet connection on port 34324 to a BigGluck backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt 37 BIND Inverse-Query buffer overflow allows remote root access (DNS_Length_Overflow) Vulnerability description The BigGluck backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the BigGluck backdoor, an attacker can retrieve Dial-Up Networking accounts and their passwords through a remote telnet connection. How to remove this vulnerability To remove BigGluck from your computer: 1. Find and delete Windll.exe. 2. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Windll.exe registry key. 3. Delete this registry key. 4. Find the HKLM\Software\Microsoft\NetDDU registry key. 5. Delete this registry key. References ISS X-Force BigGluck backdoor for Windows http://xforce.iss.net/static/3162.php BIND Inverse-Query buffer overflow allows remote root access (DNS_Length_Overflow) About this signature or vulnerability This vulnerability is detected by the DNS_Length_Overflow signature. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected BIND Type Unauthorized Access Attempt Vulnerability description BIND versions prior to 4.9.7 and BIND versions prior to 8.1.2 are vulnerable to a denial of service attack caused by a buffer overflow. By sending a specially-crafted inverse-query TCP stream, a remote attacker can overflow a buffer and cause the BIND server to crash. An attacker can use this vulnerability to gain root access to the system. How to remove this vulnerability Disable inverse queries and upgrade to the latest version of BIND (8.1.2 or later) or BIND (4.9.7 or later), as listed in CERT Advisory CA-98.05. See References. Upgrading to BIND 8.1.2 is highly recommended. — OR — Apply the BIND 8.1.1._patch, as listed in CERT Advisory CA-98.05. See References. 38 BIND Inverse-Query buffer overflow allows remote root access (DNS_Length_Overflow) For SunOS 2.x: Apply the appropriate patch for your system, as listed in Sun Microsystems, Inc. Security Bulletin #00180. See References. The inverse query feature is disabled by default, so only the systems that have been explicitly configured to allow it are vulnerable. In BIND 8, review the options block in the configuration file (typically /etc/named.conf). If there is a "fake-iquery yes;" line, then the server is vulnerable. In BIND 4.9, examine the option lines in the configuration file (typically /etc/named.boot). If there is a line containing "fake-iquery," then the server is vulnerable. In addition, unlike BIND 8, inverse query support can be enabled when the server is compiled. Examine conf/options.h in the source. If the line #defining INVQ is not commented out, then the server is vulnerable. Disabling inverse query support can break ancient versions of nslookup. If nslookup fails, replace it with a version from any BIND 4.9 or BIND 8 distribution. Disabling inverse query support can break ancient versions of nslookup. If nslookup fails, replace it with a version from any BIND 4.9 or BIND 8 distribution. See CERT Advisory CA-98.05 for vulnerable systems and vendor-specific patches. References CERT Advisory CA-1998-05 Multiple Vulnerabilities in BIND http://www.cert.org/advisories/CA-98.05.bind_problems.html CIAC Information Bulletin I-044A BIND Vulnerabilities http://ciac.llnl.gov/ciac/bulletins/i-044a.shtml Sun Microsystems, Inc. Security Bulletin #00180 BIND http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/ 180&type=0&nav=sec.sba SCO Security Bulletin 98:03 Security Vulnerability in named ftp://ftp.sco.com/SSE/security_bulletins/SB-98.03a Hewlett-Packard Security Bulletin HPSBUX9808-083 Security Vulnerability in BIND on HP-UX http://us-support.external.hp.com/index.html SGI Security Advisory 19980603-02-PX IRIX BIND DNS Vulnerabilities ftp://patches.sgi.com/support/free/security/advisories/19980603-02-PX SGI Security Advisory 19980603-01-PX IRIX BIND DNS Vulnerabilities ftp://patches.sgi.com/support/free/security/advisories/19980603-01-PX ISS X-Force BIND Inverse-Query buffer overflow allows remote root access http://xforce.iss.net/static/895.php 39 Blazer5 backdoor for Windows 95/98 and NT (Blazer5) CVE CVE-1999-0009 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0009 BIND servers can be remotely queried for their version numbers (Bind_Version_Request) About this signature or vulnerability This signature detects a DNS request for BIND version information. Default risk level Low Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 6.5 Systems affected BIND Type Pre-attack Probe Vulnerability description BIND (Berkeley Internet Name Domain) servers support the ability to be remotely queried for their version numbers. An attacker could use this feature to query computers for vulnerable versions of BIND. This information could be useful to an attacker in performing an attack. How to remove this vulnerability Disable the BIND version query feature. Refer to the BIND documentation for information on this procedure. References Internet Software Consortium (ISC) Web site BIND page http://www.isc.org/bind.html ISS X-Force BIND servers can be remotely queried for their version numbers http://xforce.iss.net/static/197.php Blazer5 backdoor for Windows 95/98 and NT (Blazer5) About this signature or vulnerability This signature detects a TCP connection on port 5000 to a Blazer5 backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 40 Bootpd remote buffer overflow (Bootp_Remote_Overflow) Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Blazer5 backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Blazer5 backdoor, an attacker can access files and the system registry. How to remove this vulnerability To remove Blazer5 from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key. 2. Find the registry entry named Load MSchv32 Drv that has a data value of C:\Windows\System\Mschv32.exe. 3. Delete this registry entry. 4. Delete Mschv32.exe from the Windows system directory. References ISS X-Force Blazer5 backdoor for Windows 95/98 and NT http://xforce.iss.net/static/3099.php Bootpd remote buffer overflow (Bootp_Remote_Overflow) About this signature or vulnerability This signature detects specially-crafted packets that have a destination port of 67 (the bootpd server). This kind of packet could indicate an attempt by an attacker to crash the bootpd server or possibly execute arbitrary commands on the server as root. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.3 Systems affected Linux kernel, FreeBSD, SCO Open Server, OpenBSD: 2.3, OpenBSD: 2.4, BSD/OS, SCO Internet FastStart, SCO UnixWare: 7.0.0, SCO UnixWare: 7.0.1 Type Unauthorized Access Attempt Vulnerability description The Internet Bootstrap Protocol (BOOTP) daemon bootpd is used in providing boot images and other information to diskless workstations. The bootp daemon shipped with several popular operating systems could allow a remote attacker to crash the bootpd server or possibly execute arbitrary commands on the server as root. Any operating system that has a bootp daemon derived from the original bootp sources is considered to 41 Bootparamd whoami (Bootparam) be vulnerable to this denial of service attack. Remote command execution has been confirmed on only the OpenBSD and BSDI platforms. How to remove this vulnerability For OpenBSD: Apply the patch for this vulnerability, as listed in OpenBSD Security Advisory, Nov 27, 1998. See References. For SCO Unix: Apply the sse018 patch for this vulnerability, as listed in SCO Security Bulletin SB-99.01. See References. As a workaround, disable the bootpd service, if possible. References BugTraq Mailing List, Fri Dec 04 1998 07:45:40 bootpd remote vulnerability http://www.securityfocus.com/archive/1/11526 OpenBSD Security Advisory, November 27, 1998 There is a remotely exploitable problem in bootpd(8) http://www.openbsd.org/errata24.html#bootpd SCO Security Bulletin 99.01 Security Vulnerability in bootpd ftp://ftp.sco.com/SSE/security_bulletins/SB-99.01a ISS X-Force Bootpd remote buffer overflow http://xforce.iss.net/static/1608.php CVE CAN-1999-0798 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0798 Bootparamd whoami (Bootparam) About this signature or vulnerability This signature detects a Bootparamd Whoami query. A Bootparamd query typically occurs when a diskless workstation boots. This event is suspicious if it occurs without a mount request within a several-minute period. This event is highly suspicious if the bootparamd query originates from outside your organization's network. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Unix Type Protocol Signature 42 Brute force login attack attempted (Brute_force_login_attack) Vulnerability description Bootparamd is a Remote Procedure Call (RPC) program used to facilitate diskless booting. An attacker attempting to obtain a computer's Network Information Services (NIS) domain name can query Bootparamd's Whoami procedure for the domain name. Knowing the domain name allows the attacker to mount more NIS-based attacks. How to remove this vulnerability A Bootparamd query typically occurs in combination with a mount request when a diskless workstation boots, which may indicate a problem with the workstation. However, if you see this query without a mount request within a few minutes, you should be suspicious. If this query originated from outside your organization, you should be highly suspicious. Consider blocking external bootparam requests. References CERT Advisory CA-1992-13 SunOS NIS Vulnerability http://www.cert.org/advisories/CA-1992-13.html CERT Advisory CA-1993-01 Revised Hewlett-Packard NIS ypbind Vulnerability http://www.cert.org/advisories/CA-1993-01.html AUSCERT Advisory AA-95.03 An overview of SATAN http://ftp.sunet.se/pub/security/csir/auscert/auscert-advisory/AA95.03.An.overview.of.SATAN ISS X-Force Bootparamd whoami http://xforce.iss.net/static/642.php Brute force login attack attempted (Brute_force_login_attack) About this signature or vulnerability This signature detects a series of login attempts that could indicate a brute force login attack on a system. Specifically, this signature detects when 5 or more Failed_loginbad_username_or_password events occur within any 60-second time period. Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Solaris, Windows NT Type Unauthorized Access Attempt Vulnerability description Any time a user attempts to log in to the system and fails to do so, an event message is written into the operating system's security log. The most typical cause of these failures is a typing error when entering the username or password. However, repeated login failures within a relatively short time period could indicate a brute-force password or username guessing attack. 43 Brute force login attack most likely successful (Brute_force_login_likely_successful) Unsophisticated attackers use repeated attempts to guess passwords. Attackers may also use automated tools to perform a large number of login attempts. Despite the relative simplicity of this kind of attack, it can be successful if users choose weak or easy-to-guess passwords. How to remove this vulnerability Well-chosen passwords are effective at defeating a brute force login attack. It is prudent to implement a security policy that requires users to change their passwords on a regular basis. Windows NT/2000: Setting up the account policy from the User Manager Utility can enforce strong password policy on a Windows system. It also can be used to cause an account to be disabled if several failed logins occur in a short time. References ISS X-Force Brute force login attack attempted http://xforce.iss.net/static/1599.php Brute force login attack most likely successful (Brute_force_login_likely_successful) About this signature or vulnerability This signature detects the possible success of a brute force login attack (a series of failed login attempts correlated with a successful login). Specifically, this signature detects when the Brute_Force_Login_attack and Successful_Login events both occur within any 30second time period. This signature will detect this event correlation regardless of the order in which the events occur. Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Solaris, Windows NT Type Unauthorized Access Attempt Vulnerability description Any time a user attempts to log in to the system and fails to do so, an event message is written into the security log. The most typical cause of these failures is a typing error when entering the username or password. However, a series of login failures occurring in a relatively short time period could indicate a brute-force login attack. A series of login failures followed by a successful login may indicate the success of such an attack. Unsophisticated attackers use repeated login attempts to guess passwords. Attackers may also use automated tools to perform a large number of login attempts. Despite the relative simplicity of this kind of attack, it can be successful if users choose weak or easy-to-guess passwords. How to remove this vulnerability 44 Well-chosen passwords are effective at defeating a brute force login attack. It is prudent to implement a security policy that requires users to change their passwords on a regular basis. Bugs backdoor for Windows 95/98 and NT (Bugs) Windows NT/2000: Setting up the account policy from the User Manager Utility can enforce strong password policy on a Windows system. It also can be used to cause an account to be disabled if several failed logins occur in a short time. References ISS X-Force Brute force login attack most likely successful http://xforce.iss.net/static/1600.php Bugs backdoor for Windows 95/98 and NT (Bugs) About this signature or vulnerability This signature detects a TCP connection on port 2115 to a Bugs backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Bugs backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Bugs backdoor, an attacker can do the following: How to remove this vulnerability ● access files ● add and remove programs that Windows loads at boot time (autoloading programs) ● control the appearance of the Windows desktop (by minimizing and maximizing windows, for example) ● retrieve shared information from programs using DDE (Dynamic Data Exchange) To remove Bugs from your computer: 1. Delete systemtr.exe from the Windows system directory. 2. Using Regedit, find the HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\run\Sys Tra registry key. 3. Delete this registry key. References Dark Eclipse Software Bugs http://www.dark-e.com/archive/trojans/bugs/index.html ISS X-Force Bugs backdoor for Windows 95/98 and NT http://xforce.iss.net/static/3336.php 45 Password change attack attempted (Change_password_attack) C2 auditing is disabled (C2_AUDIT_IS_OFF) About this signature or vulnerability This signature detects an IBM AIX or HP-UX syslog message indicating that C2 auditing has been disabled. Default risk level High Sensors that have this signature RealSecure OS Sensor: SR 1.2 Systems affected HP-UX: 11.00, AIX: 4.3 Type Suspicious Activity Vulnerability description C2 is a security rating established by the U.S. National Computer Security Center (NCSC). A C2 rating is granted to products that pass certain Department of Defense (DoD) Trusted Computer System Evaluation Criteria (TCSEC) tests. In summary, C2-rated systems ensure that users are individually accountable for their actions through login procedures, auditing of security-related events, and other criteria. For IBM AIX and HP-UX systems with a C2 rating, C2 auditing should be enabled. How to remove this vulnerability Enable C2 auditing. References ISS X-Force C2 auditing is disabled http://xforce.iss.net/static/7331.php Password change attack attempted (Change_password_attack) About this signature or vulnerability This signature detects failed attempts (five or more within one minute or less) by a user to change a password. Specifically, this signature detects when 5 or more Password_change_Failed events occur within any one-minute time period. This could indicate an attempt by an attacker to guess a user's password. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected Solaris, Windows NT, Windows 2000 Type Host Sensor 46 Password change attack possibly successful (Change_password_attack_likely_successful) Vulnerability description Many failed attempts to change a password within a short period of time may indicate attempts by an attacker to guess a password. Windows NT/2000 and Solaris will produce a "Password change failed" event for every time a user attempts and fails to change a password. Changing passwords is a common user activity. An isolated failure to change a password should not be viewed as a security event. However, something inappropriate may be happening when more than a few attempts at changing a password fail within a short period of time. In such a case, an attacker may be trying to guess a password. How to remove this vulnerability Determine what username is involved in the change attempt. If possible, verify that the owner of the account is in fact the person who is attempting to change the password. When the event first appears, you may want to temporarily disable that user account until you can investigate. Additionally, it is advisable to establish password requirements by setting a prudent account policy. References ISS X-Force Password change attack attempted http://xforce.iss.net/static/2225.php Password change attack possibly successful (Change_password_attack_likely_successful) About this signature or vulnerability This signature detects the possible success of a password change attack (a series of password change attempts correlated with a successful password change). Specifically, this signature detects when the Change_password_attack and Password_Change_successful events both occur within any 30-second time period. This signature will detect this event correlation regardless of the order in which the events occur. Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected Solaris, Windows NT Type Host Sensor Vulnerability description Failed attempts to change a password followed by a successful password change may indicate an attacker’s success in guessing and changing a password. Windows NT/2000 and Solaris will produce a "Password change successful" event for every time a user succeeds in changing a password. How to remove this vulnerability If possible, verify that the owner of the account is in fact the person who has changed the password. When the event first appears, you may want to temporarily disable the user account until you can investigate. Additionally, it is advisable to establish password requirements by setting a prudent account policy. 47 Chargen patch not applied (Chargen_Denial_of_Service) References ISS X-Force Password change attack possibly successful http://xforce.iss.net/static/2226.php Executable, system file, or other file modified (Changes_to_important_files) About this signature or vulnerability This signature detects a change made to a file on a Solaris or Windows NT/2000 system. This file should only be changed by a user with administrative privileges. Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Unix, Windows NT Type Host Sensor Vulnerability description On Windows NT/2000 or Solaris systems, whenever a program file is accessed for modification or new ownership, an object open message is written into the security log. A list of important system files and executables can be monitored for any instance where they are being modified. Because of their importance to system security, these are files that are modified infrequently and only by an administrator. Similarly, there are certain registry keys that should only be modified by an administrator because of their importance to system security. An attacker will often install an altered executable or subvert system behavior by changing an important registry key. How to remove this vulnerability Any instance of these important files and keys being modified justifies investigation. If legitimate administrative work cannot account for the event, then further investigation is needed. Examine the events and determine which files were altered. It may be safest to reinstall (or retrieve from backup) any files that were touched. References ISS X-Force Executable, system file, or other file modified http://xforce.iss.net/static/1601.php Chargen patch not applied (Chargen_Denial_of_Service) About this signature or vulnerability This vulnerability is detected by the Chargen_Denial_of_Service signature. Default risk level Medium 48 Chargen denial of service (Chargen_Denial_of_Service) Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Windows NT Type Denial of Service Vulnerability description An unpatched version of Windows NT Simple TCP/IP services has been detected. An attacker can cause a denial of service attack by sending broadcast UDP packets to the Windows NT chargen service. How to remove this vulnerability Apply the latest Windows NT 4.0 Service Pack (SP4 or later), available from the Windows NT Service Packs Web page. See References. — OR — As an alternative, Windows SP3 users can apply the post-SP3 simptcp-fix patch, as listed in Microsoft Knowledge Base Article Q1544460. See References. Windows NT Apply the latest Windows NT 4.0 Service Pack or, for Windows NT 4.0 Service Pack 3 (SP3) users, apply the post-SP3 simptcp-fix hotfix. References Microsoft Knowledge Base Article Q154460 Denial of Service Attack Against WinNT Simple TCP/IP Services http://support.microsoft.com/support/kb/articles/q154/4/60.asp CERT Advisory CA-1996-01 UDP Port Denial-of-Service Attack http://www.cert.org/advisories/CA-1996-01.html Microsoft Product Support Services Windows NT Service Packs http://support.microsoft.com/support/ntserver/Content/ServicePacks/ ISS X-Force Chargen patch not applied http://xforce.iss.net/static/259.php CVE CVE-1999-0103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0103 Chargen denial of service (Chargen_Denial_of_Service) About this signature or vulnerability This signature detects attempts at performing a denial of service attack against a computer on the network by attempting to engage a computer in a chargen flood against itself. 49 Chargen denial of service (Chargen_Denial_of_Service) Additional Vulnerabilities Found ■ chargen-patch ■ udp-dos Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected Any Type Denial of Service Vulnerability description The chargen service was detected as running. The chargen (port 19) service can be spoofed into sending data from one service on one computer to another service on another computer. This action causes an infinite loop and creates a denial of service attack. The attack can consume increasing amounts of network bandwidth, causing loss of performance or a total shutdown of the affected network segments. In addition, URLs such as "http://localhost:19" could cause a similar denial of service to a system running Lynx and chargen. Netscape Navigator disallows access to port 19 and is not vulnerable. This attack can effectively disable a Unix server by causing it to spend all its time processing packets that it has echoed back to itself. How to remove this vulnerability Disable the service, unless it is needed. In Unix: To disable chargen when started from inetd: 1. Edit the /etc/inetd.conf (or equivalent) file. 2. Locate the line that controls the chargen daemon. 3. Type a # at the beginning of the line to comment out the daemon. 4. Restart inetd. Windows: The chargen service is not native to Windows, but may be present. CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. To disable only the chargen service: 1. Open the registry editor. 2. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SimpTcp\Parame ters. 3. Double-click the EnableTcpChargen key to display the DWORD Editor. 4. Replace the value in the Data field with 0. 50 AUE_CHMOD or AUE_FCHMOD calls success and setuid bit is being turned on (Chmod_setuid) 5. Click OK. 6. Repeat steps 3 through 5 for the EnableUdpChargen key. 7. To implement your changes, stop and restart the Simple TCP/IP Service. Novell: Disable the chargen port as described in Novell Technical Information Document #2946023: 1. Install NIAS4.0 or later. 2. Load INETCFG —> Protocols —> TCP/IP, and set filter support to ENABLED. 3. Load FILTCFG —> TCP/IP —> Packet Forwarding filters, and set the status to ENABLED. 4. Verify that the action is Deny packets in filter list. Press ENTER on "(Filters: list of denied packets)". 5. Press INSERT go to packet type: Name: <all>. 6. Press ENTER, find the port chargen TCP 19. 7. Press ENTER, ESCAPE, save filters: YES. References CERT Advisory CA-1996-01 UDP Port Denial-of-Service Attack http://www.cert.org/advisories/CA-1996-01.html BugTraq Mailing List, Mon Mar 10 1997 12:05:20 Lynx/MSIE denial-of-service http://www.securityfocus.com/archive/1/6407 Novell Technical Information Document #2946023 TCPIP blocking ports (7, 9, 19, etc) http://support.novell.com/cgi-bin/search/searchtid.cgi?/10022164.htm ISS X-Force Chargen denial of service http://xforce.iss.net/static/36.php CVE CVE-1999-0103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0103 AUE_CHMOD or AUE_FCHMOD calls success and setuid bit is being turned on (Chmod_setuid) About this signature or vulnerability This signature detects when an AUE_CHMOD or AUE_FCHMOD call succeeds and the setuid bit is being turned on. False positives RealSecure Server Sensor: A false positive is possible if the user is legitimately adding a setuid to a binary. However, regardless of any user's intent, turning on the setuid bit is 51 Chupacabra backdoor for Windows (Chupacabra) considered a poor security practice. Any setuid program is difficult to secure. The creation of new setuid programs should be considered suspicious. False negatives RealSecure Server Sensor: A false negative is possible if the user process is not subject to BSM (Basic Security Module) auditing. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Unix, Solaris: 7 Type Suspicious Activity Vulnerability description On Unix systems, a set of "mode" bits is associated with every file. Some of these bits describe the permitted operations on the file (read/write/execute). One of these bits is the "setuid" bit. For an executable file, if the setuid bit is set to 1, any process running that file will have the permissions of the owner of the file. Administrators should be suspicious of any file that has the setuid bit set. How to remove this vulnerability Determine why the setuid bit was turned on for that file. Disable the setuid bit if there is not a legitimate reason for it being turned on. To disable the setuid bit, use the command 'chmod u-s FileName', where FileName is the name of the file with the setuid bit. References ISS X-Force AUE_CHMOD or AUE_FCHMOD calls success and setuid bit is being turned on http://xforce.iss.net/static/5121.php Chupacabra backdoor for Windows (Chupacabra) About this signature or vulnerability This signature detects a client communicating with a Chupacabra backdoor server on TCP port 13473. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt 52 Cisco Aironet Access Point Broadcast SSID (SNMP_Suspicious_Set) Vulnerability description How to remove this vulnerability The Chupacabra backdoor is one of many backdoor programs for Windows 95 and Windows 98 that attackers can use to access your computer system without your knowledge or consent. With the Chupacabra backdoor, an attacker can do the following: ● retrieve system and user information ● delete files ● shut down and restart the system To remove the Chupacabra backdoor from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Restart the computer in MS-DOS mode. 2. Delete the file C:\Windows\System\winprot.exe. 3. Restart the computer to Windows. Error messages will appear as the system attempts to execute the deleted winprot.exe binary. 4. In Windows, open C:\WINDOWS\WIN.INI and remove all instances of winprot.exe. These will most likely be found under the "[windows]" section on lines beginning with load= and run=. 5. Using Regedit, find each of the following registry keys, and then find and delete the registry entry named System Protect that has a value of winprot.exe: References ■ HKEY_USERS\DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\ ■ HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ ■ HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices ISS X-Force Chupacabra backdoor for Windows http://xforce.iss.net/static/5304.php Cisco Aironet Access Point Broadcast SSID (SNMP_Suspicious_Set) About this signature or vulnerability This signature detects an attempt to read or change the "Allow Associations from Broadcast SSID" feature of a Cisco Aironet Wireless Access Point. This is detected by the SNMP_Suspicious_Get signature. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Network Sensor: XPU 3.1 Systems affected Cisco Aironet Access Point Type Suspicious Activity 53 Cisco Aironet Access Point Broadcast SSID (SNMP_Suspicious_Set) Vulnerability description Cisco Aironet Access Point's installation process allows the installer to specify if devices that do not specify an SSID (Service Set Identifier) are allowed to associate with Access Point. When this feature is enabled, Access Point will respond to Broadcast SSID probe requests and also broadcast its own SSID with its Beacons. By default, Cisco Aironet Access Points ship with the "Allow Broadcast SSID to Associate" setting enabled. If this default setting is not changed, any malicious user could establish associations with Access Point to gain access to the wireless network. How to remove this vulnerability Disable the "Allow Broadcast SSID to Associate" setting. To disable the "Allow Broadcast SSID to Associate" setting: 1. Open a Web browser (for example, Microsoft Internet Explorer). 2. Type the IP address of the Cisco Aironet Access Point of interest in the browser's Address field. Depending on the security settings of Access Point, you may be prompted for a user name and password. 3. On the Summary Status page, under the Network Ports section, click the AP Radio link. There may be more than one AP Radio link. 4. On the AP Radio Port page, under the Configuration section, click the Set Properties link. 5. On the AP Radio Hardware page, select "no" for "Allow Broadcast SSID to Associate." 6. Click Apply. 7. If there was more than one AP Radio Link listed (from step 3, above), repeat steps 3 through 6 for each AP Radio Link listed. References Cisco AWCVX MIB awcVx Management Information Base http://www.ee.ethz.ch/~slist/mrtg/bin00138.bin Cisco Systems, Inc. Documentation Aironet 340 Series Wireless LAN products http://www.cisco.com/univercd/cc/td/doc/product/wireless/aironet/index.htm Cisco Technology Solutions Wireless Solutions http://www.cisco.com/warp/public/779/smbiz/netsolutions/find/wireless.shtml mrtg Mailing List, Fri, 23 Mar 2001 15:40:25 +1100 Re: [mrtg] MIBs on Radio bridges http://www.ee.ethz.ch/~slist/mrtg/msg09026.html ISS X-Force Cisco Aironet Access Point Broadcast SSID http://xforce.iss.net/static/6287.php 54 Cisco land denial of service (Land) Cisco land denial of service (Land) About this signature or vulnerability This vulnerability is detected by the Land signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 2.0 Systems affected Cisco Type Denial of Service Vulnerability description The Cisco system is vulnerable to the land denial of service attack. Recovery may require physically visiting the affected hardware. The exploit initiates a TCP connection, giving the target host's address as both source and destination, and using the same port on the target host as both the source and destination. How to remove this vulnerability IOS v10.3 to v11.2 users should upgrade to 10.3(19a), 11.0(17), 11.0(17)BT, 11.1(15), 11.1(15)AA, 11.1(15)CA, 11.1(15)IA, 11.2(10), 11.2(9)P, 11.2(4)F1, or the latest supported version for the device. As with any software upgrade, you should verify that your hardware can support the new software before upgrading. As a workaround, appropriate firewalls and some configuration workarounds to block this attack. Other workarounds using input access lists are described in the Cisco Field Notice. Patches: Cisco customers with contracts should obtain upgraded software through their regular update channels (generally via Cisco's Web site). Customers without contracts should contact Cisco TAC at tac@cisco.com. References Cisco Systems Field Notice, December 10, 1997 TCP Loopback DoS Attack (land.c) and Cisco Devices http://www.cisco.com/warp/public/770/land-pub.shtml ISS X-Force Cisco land denial of service http://xforce.iss.net/static/1246.php CVE CVE-1999-0016 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0016 55 Cisco IOS "cable-docsis" community string (Cisco_Cable_Docsis_SNMP_Community) Cisco equipment can be used to send ICMP pings through SNMP (SNMP_Suspicious_Get) About this signature or vulnerability This vulnerability is detected by the SNMP_Suspicious_Set signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Network Sensor: 3.1 Systems affected Cisco Type Protocol Signature Vulnerability description Some Cisco routers can be configured to issue ICMP echo requests through the SNMP agent. This capability can be used to load other networked devices with echo response activity. As coded here, the router is the target for the ICMP echo. This condition results in no appreciable network traffic. If repeated many times, the ICMP echo activities starve the router's I/O and memory resources and causes the router to not respond to ICMP echo. How to remove this vulnerability Set the community string to a value that is not easily guessed. Use uppercase, lowercase, and numeric characters. The router should also apply access control to allow SNMP requests from known valid source sub-networks and authorized IP addresses. References Cisco Systems Product Overview Simple Network Management Protocol (SNMP) http://www.cisco.com/warp/public/535/3.html ISS X-Force Cisco equipment can be used to send ICMP pings through SNMP http://xforce.iss.net/static/1794.php Cisco IOS "cable-docsis" community string (Cisco_Cable_Docsis_SNMP_Community) About this signature or vulnerability This signature detects an SNMP request utilizing the "cable-docsis" community name. This could indicate an attacker's attempt to compromise a Cisco router. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.3 56 Cisco Catalyst switches can be remotely crashed (Cisco_CR_DoS) Systems affected Cisco IOS Type Unauthorized Access Attempt Vulnerability description Cisco Internetwork Operating System Software (IOS) versions 12.1(3) and 12.1(3)T could allow a remote attacker to obtain the "cable-docsis" read-write community string to reconfigure the Cisco device. This is caused by a vulnerability in the implementation of DOCSIS (Data Over Cable Service Interface Specification)-compliant standards. By default, the "cable-docsis" read-write community string is undocumented and enabled. How to remove this vulnerability Upgrade to the latest version of Cisco IOS appropriate for your system, as listed in Cisco Systems Field Notice, February 28, 2001. See References. References Cisco Systems Field Notice, February 28, 2001 Cisco IOS Software Multiple SNMP Community String Vulnerabilities http://www.cisco.com/warp/public/707/ios-snmp-community-vulns-pub.shtml CERT Vulnerability Note VU#840665 Cisco IOS/X12-X15 has default SNMP read/write string of "cable-docsis" http://www.kb.cert.org/vuls/id/840665 ISS X-Force Cisco IOS "cable-docsis" community string http://xforce.iss.net/static/6180.php Cisco Catalyst switches can be remotely crashed (Cisco_CR_DoS) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.1 Systems affected Cisco Type Denial of Service Vulnerability description A vulnerability in some versions of the Cisco Catalyst switch firmware code could allow a remote attacker to cause the device to stop functioning and reload, causing a denial of service. This vulnerability has been identified in some of the Catalyst 5xxx, 29xx, and 12xx models of this hardware. How to remove this vulnerability Apply the appropriate upgrade for your system, as listed in Cisco Systems Field Notice, March 24, 1999. See References. In summary, users of affected Catalyst 5xxx and 29xx switches should upgrade to at least 2.1(6), and users of Catalyst 12xx models should upgrade to at least 4.30. 57 Cisco equipment identifies itself with packets returned from port 1999 (Cisco_Ident) References Cisco Systems Field Notice, March 24, 1999 Cisco Catalyst Supervisor Remote Reload http://www.cisco.com/warp/public/770/cat7161-pub.shtml Internet Security Systems Security Alert #24 Remote Denial of Service Vulnerability in Cisco Catalyst Series Ethernet Switches http://xforce.iss.net/alerts/advise24.php ISS X-Force Cisco Catalyst switches can be remotely crashed http://xforce.iss.net/static/2019.php CVE CVE-1999-0430 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0430 Cisco equipment identifies itself with packets returned from port 1999 (Cisco_Ident) About this signature or vulnerability This signature detects an RST packet on port 1999 with 'cisco' in the data payload. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 3.2 Systems affected Cisco Type Pre-attack Probe Vulnerability description Some Cisco equipment implements a simple identification protocol that can be used to locate devices on networks. When a TCP connection is opened to port 1999 on a Cisco router, the device returns an RST packet (normal activity) with 'cisco' in the data payload. This information could be useful to attacker in performing an attack. How to remove this vulnerability Disable connectivity for TCP port 1999 at your firewalls and border gateways to prevent remote attackers from querying your network for Cisco equipment. References BugTraq Mailing List, Sun Jan 17 1999 17:48:52 Remote Cisco Identification http://www.securityfocus.com/archive/1/11980 BugTraq Mailing List, Mon Jan 18 1999 13:40:23 Re: Remote Cisco Identification (fwd) http://www.securityfocus.com/archive/1/11985 58 Cisco IOS hidden ILMI community string could allow modification of SNMP objects (Cisco_ILMI_SNMP_Community) ISS X-Force Cisco equipment identifies itself with packets returned from port 1999 http://xforce.iss.net/static/2289.php CVE CAN-1999-0453 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0453 Cisco IOS hidden ILMI community string could allow modification of SNMP objects (Cisco_ILMI_SNMP_Community) About this signature or vulnerability This signature detects an SNMP request utilizing the "ILMI" community string, which could indicate an attacker's attempt to modify settings on Cisco or Olicom routers. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.3 Systems affected Cisco IOS: 11.x, Cisco IOS: 12.0, Crosscomm/Olicom XLT-F Router Type Unauthorized Access Attempt Vulnerability description Cisco Internetworking Operating System Software (IOS) versions 11.x and 12.0 could allow a remote attacker to view or modify SNMP objects. IOS contains access permissions on undocumented Interim Local Management Interface (ILMI) community strings. An attacker who knows of these undocumented ILMI community strings could use them to view or modify SNMP objects and gain read and write access. This vulnerability also affects Crosscomm/Olicom XLT-F Series routers. How to remove this vulnerability Upgrade to the latest version of Cisco IOS appropriate for your system, as listed in Cisco Systems Field Notice, February 27, 2001. See References. References Cisco Security Advisory 2001 February 27 Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml CERT Vulnerability Note VU#976280 Multiple networking devices allow SNMP objects to be viewed/modified via ILMI community string http://www.kb.cert.org/vuls/id/976280 BugTraq Mailing List, Sun Mar 25 2001 10:53:52 ILMI community in olicom/crosscomm routers http://www.securityfocus.com/archive/1/171337 59 Cisco IOS can be remotely crashed by invalid UDP packet (Cisco_Syslog_DoS) CIAC Information Bulletin L-052 Cisco IOS Software SNMP Read-Write ILMI Community String http://www.ciac.org/ciac/bulletins/l-052.shtml ISS X-Force Cisco IOS hidden ILMI community string could allow modification of SNMP objects http://xforce.iss.net/static/6169.php CVE CAN-2001-0711 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0711 Cisco IOS can be remotely crashed by invalid UDP packet (Cisco_Syslog_DoS) About this signature or vulnerability This signature detects malformed UDP packets directed to the Cisco syslog port (port 514). False positives RealSecure Network Sensor: A false positive may be triggered by some UDP port scans, specifically those which send malformed or dataless UDP messages. In addition, the attack detected by the IRDP_Gateway_Spoof signature may also generate a false positive for Cisos_Syslog_DoS, due to the type of UDP message used in that attack. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.3 Systems affected Cisco Type Denial of Service Vulnerability description Cisco equipment running IOS versions 12.x, 11.3AA, or 11.3DB is vulnerable to a denial of service attack, due to how IOS handles some types of UDP packets directed at the syslog port (514). An attacker can send an invalid UPD packet to port 514 to cause the device to crash, restart, or behave in an unpredictable way. How to remove this vulnerability Upgrade to the latest fixed version of Cisco IOS, as listed in Cisco Systems Field Notice, January 11, 1999. See References. As a workaround, configure ACL entries to block access to the syslog port (514), as listed in Cisco Systems Field Notice, January 11, 1999. See References. References Cisco Systems Field Notice, January 11, 1999 Cisco IOS Syslog Crash http://www.cisco.com/warp/public/770/iossyslog-pub.shtml 60 Coma backdoor for Windows 95/98 (Coma) CIAC Information Bulletin J-023 Cisco IOS Syslog Denial-of-Service Vulnerability http://www.ciac.org/ciac/bulletins/j-023.shtml AUSCERT External Security Bulletin Redistribution ESB-98.197 Cisco Security Issue Update: Update on Cisco IOS 12.0 security bug ftp://ftp.auscert.org.au/pub/auscert/ESB/ESB-98.197 BugTraq Mailing List, Tue Dec 22 1998 06:27:56 Re: Nmap network auditing/exploring tool V. 2.00 released http://www.securityfocus.com/archive/1/11648 ISS X-Force Cisco IOS can be remotely crashed by invalid UDP packet http://xforce.iss.net/static/1558.php CVE CVE-1999-0063 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0063 Coma backdoor for Windows 95/98 (Coma) About this signature or vulnerability This signature detects a TCP connection on port 10607 to a Coma backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Coma backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Coma backdoor, an attacker can do the following: How to remove this vulnerability ● retrieve system information ● execute programs ● transfer files using FTP ● log your keystrokes To remove Coma from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating 61 Compaq Web-Based Management buffer overflow (Compaq_Insight_Cpqlogin_Overflow) system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ registry key. 2. Find the registry entry named RunTime that has a data value of C:\Windows\Msgsrv36.exe. 3. Delete this registry entry. 4. Delete Msgsrv36.exe from the C:\Windows directory. References ISS X-Force Coma backdoor for Windows 95/98 http://xforce.iss.net/static/2386.php Compaq Web-Based Management buffer overflow (Compaq_Insight_Cpqlogin_Overflow) About this signature or vulnerability This signature detects an HTTP GET request to TCP port 2301 for the "cpqlogin.htm" object with a username parameter that is equal to or greater than 460 characters. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected Tru64 DIGITAL UNIX: 4.0F, Tru64 DIGITAL UNIX: 5.0, Tru64 DIGITAL UNIX: 4.0G, Compaq Armada Insight Manager: 4.20 - 4.20J, Compaq Foundation Agents: 4.90 and earlier, Compaq Enterprise Volume Manager: 1.1 and earlier, Intelligent Cluster Administrator: 2.1 and earlier, Compaq Management Agents: 4.37E and earlier, Compaq Survey Utility: 2.17 - 2.33, Compaq System Healthcheck: 3.0, Insight Management Desktop Agent: 3.70, Open SAN Manager: 1.0, SANWorks Resource Monitor: 1.0, Storage Allocation Reporter: 1.0, Compaq Insight Manager XE: 2.1 and earlier, Compaq Insight Manager LC: 1.50A and earlier Type Denial of Service Vulnerability description Compaq Web-based Management Software version 4.70 is vulnerable to a buffer overflow in the authentication page "cpqlogin.htm." By default, Compaq Web-based Management Software is installed on TCP port 2301 and is accessible by everyone. Insufficient bounds checking of the "cpqlogin.htm" authentication page could allow a remote attacker to send a username containing exactly 460 bytes to overflow a buffer and execute arbitrary code on the system with administrator privileges. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Compaq Security Advisory; Reference SSRT0705. See References. 62 Compaq Management Agent denial of service (Compaq_Insight_DoS) References eSecurityOnline Web Site Compaq web-enabled management software buffer overflow vulnerability http://www.esecurityonline.com/vulnerabilities.asp BugTraq Mailing List, Tue Jan 16 2001 15:56:06 iXsecurity.20001120.compaq-authbo.a http://www.securityfocus.com/archive/1/156486 Compaq Security Advisory, Reference SSRT0705 Compaq web-enabled management software security vulnerability. http://www5.compaq.com/products/servers/management/agentsecurity.html CIAC Information Bulletin L-042 Compaq Web-enabled Management Software Buffer Overflow http://www.ciac.org/ciac/bulletins/l-042.shtml CERT Vulnerability Note VU#137024 Compaq web-enabled management software contains buffer overflow in authentication username https://www.kb.cert.org/vuls/id/137024 ISS X-Force Compaq Web-Based Management buffer overflow http://xforce.iss.net/static/5935.php CVE CAN-2001-0134 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0134 Compaq Management Agent denial of service (Compaq_Insight_DoS) About this signature or vulnerability This signature detects traffic on TCP port 2301 that includes a GET request containing more than 220 characters. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected Compaq Insight Management Agent, Compaq Power Management: 2.0 Type Denial of Service Vulnerability description Compaq Management Agent and Compaq Survey Utility are vulnerable to a denial of service attack. Both the Management Agent and the Survey Utility provide HTTP services that allow information to be accessed through a Web browser. A vulnerability with these services could allow a user to force the Web service to stop responding. 63 Compaq Insight Management Agent allows remote retrieval of files (Compaq_Insight_Fileread) How to remove this vulnerability Compaq has fixed this issue in all Compaq Insight Management Agents after version 4.23 and Compaq Power Management after 2.0. Patches have also been made available as SSRT0612U for Tru64/DIGITAL UNIX 4.0F, Softpaq 10566 for NetWare and Softpaq 10567 for Windows NT. References BugTraq Mailing List, Thu May 27 1999 21:43:09 Re: Infosec.19990526.compaq-im.a (New DoS and correction to my previous post) http://www.securityfocus.com/archive/1/13944 Compaq Security Advisory, June 8, 1999 Compaq Management Agent Security Vulnerability http://www.compaq.com/products/servers/management/security.html Compaq FTP Download Page Index of /public/Digital_UNIX/v4.0f http://ftp1.support.compaq.com/public/Digital_UNIX/v4.0f/ Compaq Support Web site Software Patches http://ftp1.support.compaq.com/patches/public/Readmes/dunix/ ssrt0612u_im_upd06991.README ISS X-Force Compaq Management Agent denial of service http://xforce.iss.net/static/2259.php CVE CVE-1999-0772 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0772 Compaq Insight Management Agent allows remote retrieval of files (Compaq_Insight_Fileread) About this signature or vulnerability This signature detects traffic on TCP port 2301 that indicates an attempt by an attacker to use "dot dot" (/../) sequences to access files on the computer. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected Compaq Insight Management Agent, Compaq Power Management: 2.0 Type Unauthorized Access Attempt Vulnerability description The Compaq Insight Management Agent and Compaq Survey Utility provide HTTP services that allow information to be accessed through a Web browser. A vulnerability in these services could allow a user who possesses certain information about the computer to read a known file on the system. 64 Windows 2000 computer account changed (Computer_account_changed) How to remove this vulnerability Apply the SSRT0612U patch, available from the Compaq Web site. See References. This patch applies to Tru64/DIGITAL UNIX 4.0F, Softpaq 10566 for Netware, and Softpaq 10567 for Windows NT. Compaq has issued a fix for this vulnerability in all Compaq Insight Management Agents after version 4.23 and with Compaq Power Management after version 2.0. For Conectiva Linux 4.0, 4.1, 4.2, 5.0, and 5.1: Upgrade to the latest version of pam (0.72-15cl or later), as listed in CONECTIVA LINUX SECURITY ANNOUNCEMENT - pam. See References. For other distributions: Contact your vendor for upgrade or patch information. References BugTraq Mailing List, Mon Jun 07 1999 11:28:22 Update on compaq webadmin http://www.securityfocus.com/archive/1/14429 Compaq Services Software Patches New Version Insight Manager Web Agent for Compaq Tru64 UNIX V4.0F http://ftp1.support.compaq.com/public/Readmes/unix/ ssrt0612u_im_upd06991.README BugTraq Mailing List, Wed May 26 1999 16:41:36 Infosec.19990526.compaq-im.a http://www.securityfocus.com/archive/1/13912 Conectiva Linux Security Announcement CLSA-2000:112 (from SecurityFocus Archive) pam: Remote users being treated as local ones http://www.securityfocus.com/advisories/2451 ISS X-Force Compaq Insight Management Agent allows remote retrieval of files http://xforce.iss.net/static/2258.php CVE CVE-1999-0771 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0771 Windows 2000 computer account changed (Computer_account_changed) About this signature or vulnerability This signature detects a Windows event log message indicating that a computer account has been changed. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Windows 2000 65 Windows 2000 computer account created (Computer_account_created) Type Host Sensor Vulnerability description A Windows 2000 computer account has been changed. Changes to a computer account could include changing the computer's description or trust status. Windows 2000 operating system records this event in the event log so that an audit record can be retained. Alarm should be raised if unauthorized change has been applied on the computer as this might be an indication of malicious users trying to tamper with the Windows 2000 domain. How to remove this vulnerability Verify that the computer account change was authorized. References ISS X-Force Windows 2000 computer account changed http://xforce.iss.net/static/4785.php Windows 2000 computer account created (Computer_account_created) About this signature or vulnerability This signature detects a Windows event log message indicating that a computer account has been created. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Windows 2000 Type Host Sensor Vulnerability description A Windows 2000 computer account has been created. In order to authenticate with the domain controller, each computer is required to have a computer account in the Windows 2000 domain. The creation of an unauthorized computer account could indicate an attempt by an attacker to tamper with the Windows 2000 domain. How to remove this vulnerability Verify that the creation of the computer account was authorized. If necessary, remove the computer account. References ISS X-Force Windows 2000 computer account created http://xforce.iss.net/static/4786.php 66 Config file change failed (Config-log_files_delete_failed) Windows 2000 computer account deleted (Computer_account_deleted) About this signature or vulnerability This signature detects a Windows event log message indicating that a computer account has been deleted. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Windows 2000 Type Host Sensor Vulnerability description A Windows 2000 computer account has been deleted. In order to authenticate with the domain controller, each computer is required to have a computer account in the Windows 2000 domain. Unauthorized or frequent deletion of a computer account could indicate an attempt by an attacker to tamper with the Windows 2000 domain. How to remove this vulnerability Verify that the deletion of the computer account was authorized. If necessary, re-add the computer account. References ISS X-Force Windows 2000 computer account deleted http://xforce.iss.net/static/4784.php Config file change failed (Config-log_files_delete_failed) About this signature or vulnerability This signature detects a failed attempt to alter or delete an important file related to system configuration or logging. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description An attempt to alter or delete an important file related to system configuration or logging has failed. An attempt to alert a file includes attempts to modify the contents of the file, or to change its ownership or permissions. These important files are those found under "%SystemRoot%\system32\config" and "%SystemRoot%\repair". 67 Config-log files deleted (Config-log_files_deleted) Files stored under "%SystemRoot%\system32\config" include registry files and event log files. They should only be accessed through appropriate tools provided by Windows NT (such as RegEdit or Regedt32 for the registry and Event Viewer for event logs). They should be owned by the system administrator and ordinary users should only have read access to them. These files should never be deleted. The files stored under "%SystemRoot%\repair" are backup copies of files under "%SystemRoot%\system32\config" and should not be manually changed. How to remove this vulnerability When this event happens, you should immediately determine who is trying to access these files and why. You should make sure that the ownership and permission of these files are correct. References ISS X-Force Config file change failed http://xforce.iss.net/static/2220.php Config-log files deleted (Config-log_files_deleted) About this signature or vulnerability This signature detects a failed attempt to modify, delete, change ownership, or change permissions of an important file related to system configuration or logging. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description An attempt to modify, delete, change ownership, or change permissions of an important file related to system configuration or logging has occurred. That attempt has failed. These important files are those found under "%SystemRoot%\system32\config" and "%SystemRoot%\repair". Files stored under "%SystemRoot%\system32\config" include registry files and event log files. They should only be accessed through appropriate tools provided by Windows NT (such as Regedit or Regedt32 for the registry and Event Viewer for event logs). They should be owned by the system administrator and ordinary users should only have read access to them. These files should never be deleted. The files stored under "%SystemRoot%\repair" are backup copies of files under "%SystemRoot%\system32\config" and should not be manually changed. How to remove this vulnerability 68 When this event happens, immediately determine who is making the changes and why. You should immediately restore the original files or correct the ownership/permissions on the affected files. Connection backdoor for Windows 95/98 (Connection_Backdoor) References ISS X-Force Config-log files deleted http://xforce.iss.net/static/2219.php Connection backdoor for Windows 95/98 (Connection_Backdoor) About this signature or vulnerability This signature detects a TCP connection on port 60411 to a Connection backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Connection backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Connection backdoor, an attacker can view the contents of the file system and display cached passwords. How to remove this vulnerability To remove the Connection backdoor from your computer: CAUTION: Use Registry Editor at your own risk. Any change made with Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Press Ctrl+Alt+Del to display the Close Programs dialog box. 2. Select the Winoldap program from the list. 3. Click the End Task button. 4. Using Regedit, find the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key. 5. Find and delete the registry entry named Winrun that has a data value of c:\win\system\winrun.exe. 6. If the file C:\win\system\winrun.exe exists, delete it. 7. Restart your computer. References TL Security Web site Connection http://www.tlsecurity.net/backdoor/connection.htm 69 Process created core file; effective UID is root, real id is non-root (Core_event_setuid) ISS X-Force Connection backdoor for Windows 95/98 http://xforce.iss.net/static/4848.php Process created core file; effective UID is root, real id is nonroot (Core_event_setuid) About this signature or vulnerability This signature detects when a process creates a core file, the effective UID is root, the real ID is not root, and there is no path for the core file. This particular circumstance could indicate an attacker's attempts to refine buffer overflow attacks on setuid processes. False positives RealSecure Server Sensor: A false positives is possible if an event other than an attack causes the program to dump core. Regardless, all causes of core dumps should be investigated. False negatives RealSecure Server Sensor: A false negative is possible for processes that are not subject to BSM (Basic Security Module) auditing. Default risk level Low Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Unix, Solaris: 2.6, Solaris: 7 Type Suspicious Activity Vulnerability description Occasionally, flaws in root processes can cause those processes to generate core files. This can create security concerns for two reasons. First, root processes sometimes have parts of the shadow password file in memory when they core out. The core file contains this shadow password information. Second, core events could be the result of an attacker's attempts to exploit buffer overflow vulnerabilities. If the attacker's attempted exploit has not been fine-tuned, it could result in generating a core instead of providing a root shell. How to remove this vulnerability Determine what setuid program is dumping core and immediately remove the setuid bit from that program. As an immediate follow-up, search for security advisories that address that program and install any patches that might be recommended in those advisories. It is possible that the program is under attack and needs to be fixed before the attacker manages to successfully exploit the vulnerability. References ISS X-Force Process created core file; effective UID is root, real id is non-root http://xforce.iss.net/static/5122.php 70 CrazzyNet backdoor for Windows (CrazzyNet) CrazzyNet backdoor for Windows (CrazzyNet) About this signature or vulnerability This signature detects a CrazzyNet backdoor server active on TCP port 17499 on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The CrazzyNet backdoor is one of many backdoor programs for Windows 95 and Windows 98 that attackers can use to access your computer without your knowledge or consent. Once a system is infected, the backdoor places a server on TCP ports 17499 and 17500, which allows a remote client to connect and perform dozens of functions on the host including: How to remove this vulnerability ● retrieve cached passwords ● manipulate the current Windows session ● modify and retrieve system settings ● log all keystrokes ● upload, download and execute arbitrary files To remove a default installation of CrazzyNet from your computer: CAUTION: Use Registry Editor at your own risk. Any change made with Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Open C:\Windows\Win.ini and find the run key under the [windows] section and delete the file entry named Registry32.exe. 2. Open C:\Windows\System.ini and find the shell key under the [boot] section and delete the file entry named Registry32.exe. 3. Using Regedit, find the registry key named Reg32 that has a data value of Registry32.exe. Select Edit —> Find. Select the "Values" checkbox, and then type "registry32.exe" in the Find What field. Click the Find Next button. (This key is placed by the backdoor inside the HKEY_USERS hive under the username of the person who originally executed the backdoor.) 4. Delete the Reg32 registry key. 5. Restart your computer. 6. Delete the file C:\Windows\Registry32.exe. 71 CyberCop Scanner is a commercial network vulnerability auditing tool (CyberCop_Scanner) The CrazzyNet backdoor can be difficult to remove manually, because it is configurable, making it difficult to identify on your system. If the above instructions do not remove the CrazzyNet backdoor, refer to the steps below for using an anitvirus program to remove the backdoor. To use an antivirus program to remove the CrazzyNet backdoor: 1. If you do not have an antivirus program installed, download and install one of these virus scanners: ■ Norton AntiVirus: http://www.symantec.com/nav/indexA.html ■ McAfee VirusScan: http://software.mcafee.com/centers/download/ ■ Trend Micro PC-Cillin: http://www.trend.com/pc-cillin/ 2. Run the antivirus program to scan your system for this backdoor. The virus scanner should find and remove the CrazzyNet backdoor from your computer. References ISS X-Force CrazzyNet backdoor for Windows http://xforce.iss.net/static/5541.php CyberCop Scanner is a commercial network vulnerability auditing tool (CyberCop_Scanner) About this signature or vulnerability This signature detects a scan performed by CyberCop Scanner. False positives RealSecure Network Sensor: RealSecure detects any use of CyberCop Scanner, including legitimate and authorized use the product. RealSecure Server Sensor: RealSecure detects any use of CyberCop Scanner, including legitimate and authorized use the product. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected Any Type Pre-attack Probe Vulnerability description Network Associates, Inc. CyberCop Scanner is a commercial network and systems vulnerability scanner. The results of a scan by this utility could provide an attacker information about the weaknesses of your network and systems. This information could be useful to an attacker in performing an attack. How to remove this vulnerability If the scan is determined to be unauthorized, determine the origin of the scan and deny access to your networks from the offending host. 72 Unauthorized attempt to start DCOM server (dcomsrv_deny) References ISS X-Force CyberCop Scanner is a commercial network vulnerability auditing tool http://xforce.iss.net/static/2049.php Unauthorized attempt to start DCOM server with DefaultLaunchPermission (dcomdef_deny) About this signature or vulnerability This signature detects a Windows event log message indicating that an attempt to launch a DCOM server using DefaultLaunchPermission was denied. Default risk level High Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description DCOM (Distributed Component Object Model) application security settings permit default launch permissions for all DCOM applications that do not provide their own security permission settings. Users that are not in the Default Launch Permissions list will be denied access. Any unauthorized attempt to start the DCOM server could be an indication of attacker activity. How to remove this vulnerability Identify the user that attempted to start the DCOM server. Run dcomcnfg.exe to review and configure the security properties and launch permissions for the DCOM application in question. For stronger security, review and manage the security permissions at the individual file level for the DCOM application so that only intended security principals have access. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Unauthorized attempt to start DCOM server with DefaultLaunchPermission http://xforce.iss.net/static/4633.php Unauthorized attempt to start DCOM server (dcomsrv_deny) About this signature or vulnerability This signature detects a Windows event log message indicating that an unauthorized attempt to start the DCOM server has occurred. Default risk level High 73 Invalid packet with all TCP options set (IPProtocolViolation) Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description DCOM (Distributed Component Object Model) application security settings permit custom launch permissions to be set for any DCOM application that provides its own list of authorized users who can launch the application. Users that are not in the custom launch permissions list will be denied access. Any unauthorized attempt to start the DCOM server could be an indication of attacker activity. How to remove this vulnerability Identify the user that attempted to start the DCOM server. Run dcomcnfg.exe to review and configure the security properties and launch permissions for the DCOM application in question. For stronger security, review and manage the security permissions at the individual file level for the DCOM application so that only intended security principals have access. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Unauthorized attempt to start DCOM server http://xforce.iss.net/static/4634.php Invalid packet with all TCP options set (IPProtocolViolation) About this signature or vulnerability This vulnerability is detected by the IPProtocolViolation signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 2.5 Systems affected Any Type Pre-attack Probe Vulnerability description A "lamp test segment" is a packet in which all TCP flags are set (SYN, FIN, URG, ACK, RST, and PSH). This type of packet is often referred to as a christmas tree or xmas tree packet, kamikaze packet, or a nastygram and is commonly used in port scanning software in a pre-attack probe. This type of packet is never legal and indicates either severely misconfigured equipment or malicious intent. 74 DeepThroat backdoor for Windows (DeepThroat) How to remove this vulnerability This type of packet is not legal. Configure your routers to drop packets of this nature. References Request for Comment document RFC 1025 TCP AND IP BAKE OFF http://www.merit.edu/internet/documents/rfc/rfc1025.txt ISS X-Force Invalid packet with all TCP options set http://xforce.iss.net/static/1476.php DeepThroat backdoor for Windows (DeepThroat) About this signature or vulnerability This signature detects a connection to a DeepThroat backdoor on your network on UDP port 2140. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The DeepThroat backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the DeepThroat backdoor, an attacker can do the following: How to remove this vulnerability ● access files and the system registry ● execute programs ● open a Web browser to a URL ● open and close your CD-ROM drive ● start and stop an FTP server on your computer ● send messages that appear on your screen ● retrieve cached passwords To remove the DeepThroat backdoor from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating 75 Deltasource backdoor for Windows (DeltaSource) system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. 2. Identify the DeepThroat registry entry. The entry could have one of two names: ■ SystemDLL32 (for DeepThroat version 1.0) ■ Systemtray (for DeepThroat version 2.0 or 3.0) 3. Stop the DeepThroat program from running. This process is different based on the version of Windows you are running. ■ Windows 95/98: Restart the computer in MS-DOS mode. Proceed to step 4. ■ Windows NT: Press CTRL+ALT+DEL, then click the Task Manager button to start the NT Task Manager. Click the Processes tab, and search the list for the file you identified in step 2. Select the file, and click End Process. 4. Delete the DeepThroat program file that you identified in step 2. ■ Windows 95/98: From the DOS command prompt, delete the file from the path named in the registry value. ■ Windows NT: Delete the file from the path named in the registry value. 5. Using Regedit, delete the registry entry you identified in step 2. References DarkLightCorp Web site Deep Throat Backdoor http://dlcorp.hypermart.net/index2.html Internet Security Systems Security Alert #30 Windows Backdoor Update III http://xforce.iss.net/alerts/advise30.php ISS X-Force DeepThroat backdoor for Windows http://xforce.iss.net/static/2290.php Deltasource backdoor for Windows (DeltaSource) About this signature or vulnerability This signature detects a connection to a Deltasource backdoor on your network on UDP port 47262. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt 76 RealSecure sensor error message (Detector_Error) Vulnerability description How to remove this vulnerability The Deltasource backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Deltasource backdoor, an attacker can do the following: ● access files ● access your system registry ● execute programs To remove the Deltasource backdoor from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ registry key. 2. Find the registry entry named DS admin tool. The entry's data value contains the path to the program file, Server.exe. Remember the location of the file. 3. Delete this registry entry. 4. Delete Server.exe from the path named in the registry value. References ISS X-Force Deltasource backdoor for Windows http://xforce.iss.net/static/3122.php RealSecure sensor error message (Detector_Error) About this signature or vulnerability This signature detects a RealSecure sensor error message, which may indicate that the sensor has stopped functioning. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.01 Systems affected RealSecure Type Protocol Signature Vulnerability description RealSecure sensors notify the console when significant events occur that relate to the sensor's operation. There are three types of events that may be reported by the sensor: Error, Warning, and Information. Error events indicate that the sensor may have stopped functioning, and they should be investigated immediately. The specific error message will give further details about the problem, and how it may have affected the sensor. If the error applies to only one subsystem of the sensor, it is 77 RealSecure sensor information message (Detector_Info) possible that the sensor may continue to function; however, a RealSecure administrator should inspect the sensor to verify that it is functioning properly. An example of a RealSecure error message is "Operation Failed - WSAECONNRESET - Connection reset by peer". How to remove this vulnerability Verify that the sensor is functioning properly. Correct any problems with the sensor as appropriate. More information about common RealSecure sensor error messages is available in the SAFEsuite Support Knowledgebase. See References. References Internet Security Systems, Inc. SAFEsuite Support Knowledgebase http://www.iss.net/customer_care/knowledgebase/ ISS X-Force RealSecure sensor error message http://xforce.iss.net/static/6127.php RealSecure sensor information message (Detector_Info) About this signature or vulnerability This signature detects a RealSecure sensor information message, which may provide useful information about normal sensor operations. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 3.01 Systems affected RealSecure Type Protocol Signature Vulnerability description RealSecure sensors notify the console when significant events occur that relate to the sensor's operation. There are three types of events that may be reported by the sensor: Error, Warning, and Information. Information events are usually status messages about normal system operation that are helpful for logging but do not require individual attention. The specific information message will give further details about the event. Information messages are often associated with services initializing and other successful operations. While these types of activities do not require any immediate intervention, they often contain useful information, and a RealSecure administrator may want to track these events for logging purposes. How to remove this vulnerability 78 No action is needed to respond to Information event messages, because they are a part of normal sensor operation. RealSecure sensor warning message (Detector_Warning) More information about common RealSecure sensor information messages is available in the SAFEsuite Support Knowledgebase. See References. References Internet Security Systems, Inc. SAFEsuite Support Knowledgebase http://www.iss.net/customer_care/knowledgebase/ ISS X-Force RealSecure sensor information message http://xforce.iss.net/static/6128.php RealSecure sensor warning message (Detector_Warning) About this signature or vulnerability This signature detects RealSecure sensor warning messages, which may indicate that a minor problem has occurred with the sensor. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.01 Systems affected RealSecure Type Protocol Signature Vulnerability description RealSecure sensors notify the console when significant events occur that relate to the sensor's operation. There are three types of events that may be reported by the sensor: Error, Warning, and Information. Warning events are usually status messages about minor problems encountered by the sensor that do not need immediate attention. The specific warning message will give further details about the problem, and how it may have affected the sensor. Warning messages are typically associated with recoverable problems that do not cause a loss of functionality or data; however, a RealSecure administrator may want to inspect the sensor to verify that it is functioning properly. An example of a RealSecure warning message is "An error occurred when attempting to obtain the sensor's current.policy file. The system cannot find the path specified". How to remove this vulnerability Verify that the sensor is functioning properly. Correct any problems with the sensor as appropriate. More information about common RealSecure sensor warning messages is available in the SAFEsuite Support Knowledgebase. See References. References Internet Security Systems, Inc. SAFEsuite Support Knowledgebase http://www.iss.net/customer_care/knowledgebase/ 79 Devil backdoor for Windows (Devil) ISS X-Force RealSecure sensor warning message http://xforce.iss.net/static/6129.php Devil backdoor for Windows (Devil) About this signature or vulnerability This signature detects commands being sent on TCP port 65000 to a Devil backdoor on your network. The specific command executed and a description of that command will be reported in the Raw Command and Command Description information fields, respectively. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Devil backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Devil backdoor, an attacker can: How to remove this vulnerability ● open and close your CD-ROM drive door ● perform application bombs (an application is executed so many times that it floods the screen) ● make your computer's speaker beep ● stop ICQ if it is running ● restart your computer To remove the Devil backdoor from your computer: 1. Restart Windows to stop the Devil backdoor. The Devil backdoor does not automatically restart when Windows loads. 2. Find and delete the Devil server program file. The program may be disguised as any one of the following file names: 80 ■ Devil13.exe ■ ICQFlood.exe ■ Mswinsck.ocx (required to run the Trojan) ■ Opscript.exe ■ Socket.exe ■ Winamp34.exe ■ Wingenocide.exe ■ Winrar.exe DG/UX finger shell metacharacters allowed (Finger_Perl) ■ References Taupe.zip Simovits Consulting Web site Devil http://www.simovits.com/trojans/tr_data/y334.html ISS X-Force Devil backdoor for Windows http://xforce.iss.net/static/4144.php DG/UX finger shell metacharacters allowed (Finger_Perl) About this signature or vulnerability This vulnerability is detected by the Finger_Perl signature. Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.0 Systems affected DG/UX Type Unauthorized Access Attempt Vulnerability description Some older DG/UX finger daemons were vulnerable to shell metacharacter attacks, allowing attackers to execute arbitrary commands on the system through the finger port. How to remove this vulnerability Upgrade to the latest version of DG/UX (4.20 or later), available from the Data General Web site. See References. References BugTraq Mailing List, Wed Aug 20 1997 13:55:46 Re: in.fingerd vulnerability http://www.securityfocus.com/archive/1/7510 BugTraq Mailing List, Mon Aug 11 1997 09:32:38 dgux in.fingerd vulnerability http://www.securityfocus.com/archive/1/7486 Data General Web site DG/UX Release 4.2 Operating System http://www.dg.com/products/html/dg_ux.html ISS X-Force DG/UX finger shell metacharacters allowed http://xforce.iss.net/static/302.php CVE CVE-1999-0152 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0152 81 Client broadcasts DHCP Discover messages to locate available servers (DHCP_Discover) DHCP Ack from server to client (DHCP_Ack) About this signature or vulnerability This signature detects DHCP (Dynamic Host Configuration Protocol) Ack packets originating from a DHCP server. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 6.5, RealSecure Network Sensor: XPU 3.4, RealSecure Server Sensor: 6.5 Systems affected Windows, Unix Type Protocol Signature Vulnerability description Dynamic Host Configuration Protocol (DHCP) aids in the administration of IP networks by providing individual client computers their respective configurations. Clients send DHCP Requests to the DHCP server. In turn, the DHCP server replies with an acknowledgement (Ack) message that contains configuration parameters, including the committed network address. How to remove this vulnerability This issue does not directly indicate any type of vulnerability. Monitor DHCP server log files for suspicious activity. References RFC 2131 Dynamic Host Configuration Protocol http://sunsite.dk/RFC/ ISS X-Force DHCP Ack from server to client http://xforce.iss.net/static/7131.php Client broadcasts DHCP Discover messages to locate available servers (DHCP_Discover) About this signature or vulnerability This signature detects DHCP (Dynamic Host Configuration Protocol) Discover packets originating from a client. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 6.5, RealSecure Network Sensor: XPU 3.4, RealSecure Server Sensor: 6.5 Systems affected Windows, Unix Type Protocol Signature 82 Client DHCP Request (DHCP_Request) Vulnerability description Dynamic Host Configuration Protocol (DHCP) aids in the administration of IP networks by providing individual client computers their respective configurations. A client will broadcast DHCP Discover messages in attempts to locate available DHCP servers. The client then sends DHCP Requests to a discovered DHCP server, which in turn provides configuration information to the client. How to remove this vulnerability This issue does not directly indicate any type of vulnerability. Monitor DHCP server log files for suspicious activity. References RFC 2131 Dynamic Host Configuration Protocol http://sunsite.dk/RFC/ ISS X-Force Client broadcasts DHCP Discover messages to locate available servers http://xforce.iss.net/static/7132.php Client DHCP Request (DHCP_Request) About this signature or vulnerability This signature detects DHCP (Dynamic Host Configuration Protocol) Request packets originating from a client. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 6.5, RealSecure Network Sensor: XPU 3.4, RealSecure Server Sensor: 6.5 Systems affected Windows, Unix Type Protocol Signature Vulnerability description Dynamic Host Configuration Protocol (DHCP) aids in the administration of IP networks by providing individual client computers their respective configurations. Clients send DHCP Requests to the DHCP server, which in turn provides configuration information to the client. The various kinds of DHCP Request messages a client can send include: How to remove this vulnerability ● requests for offered parameters from one server (offers from other DHCP servers are implicitly declined) ● requests to confirm the correctness of previously allocated addresses after, for example, a system restart ● requests to extend the lease for a particular network address This issue does not directly indicate any type of vulnerability. Monitor DHCP Server log files for suspicious activity. 83 DNS request made for all records (DNS_All) References RFC 2131 Dynamic Host Configuration Protocol http://sunsite.dk/RFC/ ISS X-Force Client DHCP Request http://xforce.iss.net/static/7133.php Disk space at or near capacity (Disk_space_shortage) About this signature or vulnerability This signature detects a Windows system log message indicating that a Windows drive is at or near its capacity. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description This event is an alert to the condition that a Windows NT drive is at or near its capacity. This condition is detected from an entry that appears in the Windows NT system log. A full disk device can result in failures for any processes that may use the drive. How to remove this vulnerability A full disk device is not typically the result of an attacker's activities. However, a full drive can compromise the performance of a system and result in program failure or a compromise to the security system. Take action to free up disk space and to provide more disk space as needed. References ISS X-Force Disk space at or near capacity http://xforce.iss.net/static/1596.php DNS request made for all records (DNS_All) About this signature or vulnerability This signature detects a DNS request for all records about a host. False positives RealSecure Network Sensor: A DNS request of this type can occur during normal use of DNS and may not indicate an attack. Default risk level Medium 84 Microsoft DNS Server - excessive bad packets received (dns_bad_pkts) Sensors that have this signature RealSecure Network Sensor: 3.2 Systems affected DNS Type Pre-attack Probe Vulnerability description A DNS request for all records about a host can indicate a pre-attack probe of a network. With tools such as "dig," an attacker may make such DNS requests to gain information about your network, which could be useful to an attacker in performing an attack. However, normal, legitimate use of DNS may also involve such DNS requests. How to remove this vulnerability Events of this type are most likely part of normal and benign DNS queries. Sites requesting this information should be monitored for events that could indicate an attack or further probing. References Acme Byte & Wire LLC Securing Your Name Server http://www.acmebw.com/papers/securing.pdf ISS X-Force DNS request made for all records http://xforce.iss.net/static/1444.php Microsoft DNS Server - excessive bad packets received (dns_bad_pkts) About this signature or vulnerability This signature detects a Windows event log message indicating that Microsoft DNS Server is receiving an excess number of bad packets and is suppressing event logging of bad packets. Default risk level High Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description Bad DNS packets occur infrequently in a production DNS environment. Receiving an excess number of bad DNS packets in a short period of time could indicate a problem with the remote DNS application, or an attack on the DNS server. In addition, after an excessive number of bad packets, the DNS server may stop logging these packets and DNS server tracing capability may be lost. 85 Microsoft DNS Server - CNAME loop during caching (dns_cname) How to remove this vulnerability Investigate the origin of the bad DNS packets. If the sending host is located inside the firewall, determine if any suspicious applications are running on the computer. Remove the host from the network if necessary. If the sending host is located outside the firewall, create a filter on the firewall to prevent bad packets from reaching the DNS server. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Microsoft DNS Server - excessive bad packets received http://xforce.iss.net/static/4676.php Microsoft DNS Server - CNAME loop during caching (dns_cname) About this signature or vulnerability This signature detects a Windows event log message indicating that a CNAME loop has been detected by Microsoft DNS Server during caching. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description Microsoft DNS Server is capable of detecting when a new CNAME resource record forms a CNAME loop with an existing CNAME resource record while trying to cache the new resource record. If this happens, the new CNAME resource record will be ignored. This CNAME loop may cause the DNS server to loop while trying to resolve a queried name. This may indicate an error in the remote DNS application, or an attempt by an attacker to pollute the DNS server cache. How to remove this vulnerability Ensure that the DNS server does not cache polluted CNAME resource records. Investigate the source of the bad CNAME resource record. If the sending host is located inside the firewall, determine if any suspicious applications are running on the system. Remove the host from the network if necessary. If the sending host is located outside the firewall, create a filter on the firewall to prevent bad packets from reaching the DNS server. 86 DNS hostname exceeding maximum length (DNS_Hostname_Overflow) References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Microsoft DNS Server - CNAME loop during caching http://xforce.iss.net/static/4635.php DNS HINFO request (DNS_HInfo) About this signature or vulnerability This signature detects a Domain Name System (DNS) request for an HINFO (Host Info) record about a target host. The target system name will be listed in the event. False positives RealSecure Network Sensor: Some network management tools or other services may make these requests while scanning a network. However, if you have no such tools and no HINFO records on your DNS server, then this attack is almost always indicative of malicious intent. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 2.5 Systems affected DNS Type Pre-attack Probe Vulnerability description Domain Name System (DNS) requests can be made for an HINFO (Host Info) record about a target host. These records list, among other things, the CPU type and host operating system of the target system. Such information could be useful to an attacker in planning an attack. How to remove this vulnerability Remove all HINFO records from your DNS server, unless their presence is required. Also, following the HINFO request, monitor the target system for suspicious activity. References ISS X-Force DNS HINFO request http://xforce.iss.net/static/1224.php DNS hostname exceeding maximum length (DNS_Hostname_Overflow) About this signature or vulnerability This signature detects a Windows event log message indicating that a domain name exceeding the maximum name length has been detected by the Microsoft DNS Server. 87 DNS hostname exceeding maximum length (DNS_Hostname_Overflow) False positives RealSecure Network Sensor: Queries requesting non-RFC compliant hostnames will appear to be this attack. RealSecure Server Sensor: Queries requesting non-RFC compliant hostnames will appear to be this attack. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, DNS, Windows 2000, BIND: 4.x Type Suspicious Activity Vulnerability description DNS responses for hostnames should not exceed a certain fixed length. A domain name exceeding the maximum length of 255 octets could indicate one of the following events: ● a zone file error ● incorrectly entered hostnames in nslookup queries ● an attempt by an attacker to manipulate the DNS server When Microsoft DNS Server encounters a resource record with a domain name exceeding the maximum length of 255 octets, the resource record is ignored by the DNS server. Versions 4.x and earlier of BIND (Berkeley Internet Name Domain, a DNS server available for most versions of Unix) do not validate the maximum domain name length of 255 octets. Hostnames longer than this length can be returned to client programs performing DNS lookups. Client programs that do not check the length of the hostnames returned may overflow internal buffers when copying this hostname, allowing a remote attacker to gain root access or execute arbitrary commands on a targeted client computer. How to remove this vulnerability Investigate the source of the invalid domain name. Ensure that the master DNS server is using the correct zone file. Correct any errors in the DNS zone file, such as bad DNS resource records, that are reported in the DNS error log. Ensure that security permissions are configured so that only the intended security principals have access. — AND — If you are using a version of BIND earlier than 4.x, upgrade to the latest version of BIND (8.2.2 patchlevel 5 or later), available from the BIND Web site. See References. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp Internet Software Consortium (ISC) Web site Current release http://www.isc.org/products/BIND/ 88 Microsoft DNS Server - Invalid domain name offset in DNS message packet (dns_inv_dom_offset) ISS X-Force DNS hostname exceeding maximum length http://xforce.iss.net/static/636.php Microsoft DNS Server - Invalid domain name (dns_inv_dom) About this signature or vulnerability This signature detects a Windows event log message indicating that an invalid domain name has been detected by Microsoft DNS Server. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description Microsoft DNS Server encountered an invalid domain name. An invalid domain name could indicate an error in the DNS zone file, or an attempt by an attacker to manipulate the DNS Server. How to remove this vulnerability Investigate the source of the invalid domain name. Ensure that the master DNS server is using the correct zone file. Correct any errors in the DNS zone file, such as bad DNS resource records, that are reported in the DNS error log. Ensure that security permissions are configured so that only the intended security principals have access. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Microsoft DNS Server - Invalid domain name http://xforce.iss.net/static/4663.php Microsoft DNS Server - Invalid domain name offset in DNS message packet (dns_inv_dom_offset) About this signature or vulnerability This signature detects a Windows event log message indicating that an invalid domain name offset in the DNS message packet has been detected by Microsoft DNS Server. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 89 Microsoft DNS Server - Invalid domain name in DNS message packet (dns_inv_dom_pkt) Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description An invalid domain name offset in a DNS message packet occurs infrequently in a production DNS environment. An invalid domain name offset could be the result of a remote DNS application error, or an attempt by an attacker to manipulate the DNS server remotely. How to remove this vulnerability Investigate the origin of the invalid DNS message packet. If the sending host is located inside the firewall, determine if any suspicious applications are running on the computer. Remove the host from the network if necessary. If the sending host is located outside the firewall, create a filter on the firewall to prevent bad packets from reaching the DNS server. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Microsoft DNS Server - Invalid domain name offset in DNS message packet http://xforce.iss.net/static/4675.php Microsoft DNS Server - Invalid domain name in DNS message packet (dns_inv_dom_pkt) About this signature or vulnerability This signature detects a Windows event log message indicating that an invalid domain name in a DNS message packet has been detected by Microsoft DNS Server. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description An invalid domain name in a DNS message packet occurs infrequently in a production DNS environment. An invalid domain name in the DNS message packet could be the result of a remote DNS application error, or an attempt by an attacker to manipulate the DNS server remotely. Even though the bad packet has been rejected, this event should be considered suspicious. 90 Microsoft DNS Server - Invalid DNS UPDATE message in DNS packet (dns_inv_updated) How to remove this vulnerability Investigate the origin of the invalid DNS packet. If the sending host is located inside the firewall, determine if any suspicious applications are running on the computer. Remove the host from the network if necessary. If the sending host is located outside the firewall, create a filter on the firewall to prevent bad packets from reaching the DNS server. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Microsoft DNS Server - Invalid domain name in DNS message packet http://xforce.iss.net/static/4654.php Microsoft DNS Server - Invalid DNS UPDATE message in DNS packet (dns_inv_updated) About this signature or vulnerability This signature detects a Windows event log message indicating that an invalid DNS UPDATE message in a DNS packet has been detected by Microsoft DNS Server. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description The DNS UPDATE operation can be used to modify DNS resource records dynamically on the master DNS server. Normally, DNS updates should only be accepted from trusted hosts. Invalid DNS UPDATE messages occur infrequently in a production DNS environment, and could be the result of a remote DNS application error, or an attempt by an attacker to manipulate the DNS server remotely. Even though the bad packet has been rejected, this event should be considered suspicious. How to remove this vulnerability Investigate the origin of the invalid DNS UPDATE packet. If the sending host is located inside the firewall, determine if any suspicious applications are running on the computer. Remove the host from the network if necessary. If the sending host is located outside the firewall, create a filter on the firewall to prevent bad packets from reaching the DNS server. 91 DNS server inverse queries (DNS_Iquery) Review and configure your DNS server policy so that DNS UPDATE is only accepted from authorized hosts. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Microsoft DNS Server - Invalid DNS UPDATE message in DNS packet http://xforce.iss.net/static/4677.php DNS server inverse queries (DNS_Iquery) About this signature or vulnerability This signature detects an IQUERY probe directed at your DNS server, which could indicate an attacker's attempt to obtain a zone transfer. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 6.5 Systems affected DNS Type Suspicious Activity Vulnerability description The Inverse Query (iquery) feature supported on some DNS servers could allow an attacker to obtain a zone transfer. Zone transfers identify every computer registered with your DNS server and can be used by an attacker to better understand your network. Even if you have disabled zone transfers on your DNS server, the iquery feature will still permit a zone transfer to occur. How to remove this vulnerability Configure your DNS server to disable inverse queries. According to ISC, there are no known vulnerabilities in the current iquery code as of BIND 8.2.2-P5 and BIND 8.2.3-TB2. For more information on inverse queries, see RFC 1035, "Domain Names Implementation and Specification" as listed in the References. References Request for Comment document RFC 1035 Domain Names - Implementation and Specification http://www.rfc-editor.org/rfc/rfc1035.txt Acme Byte & Wire LLC Securing Your Name Server http://www.acmebw.com/papers/securing.pdf 92 Overflowing DNS IPv4 length allows attackers to gain access (DNS_Length_Overflow) BIND Users Mailing List Archive, Fri, 14 Apr 2000 09:36:11 +1000 Re: iquery and Cybercop Scanner http://www.isc.org/ml-archives/bind-users/2000/04/msg00680.html ISS X-Force DNS server inverse queries http://xforce.iss.net/static/206.php Overflowing DNS IPv4 length allows attackers to gain access (DNS_Length_Overflow) About this signature or vulnerability Additional Vulnerabilities Found This signature detects a DNS response for which the length field is not 4 bytes long. ■ bind-bo False positives RealSecure Network Sensor: It is possible a DNS lookup of a string greater than or equal to 255 bytes will trigger this attack. It is also possible than an IPv6 DNS response on an IPv4 network will trigger it as well. However, these events are very unlikely. Consider each event as suspicious. RealSecure Server Sensor: It is possible a DNS lookup of a string greater than or equal to 255 bytes will trigger this attack. It is also possible than an IPv6 DNS response on an IPv4 network will trigger it as well. However, these events are very unlikely. Consider each event as suspicious. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 6.5 Systems affected DNS, Solaris: 2.5, Solaris: 2.5.1, AIX: 3.2.x, AIX: 4.1.x, AIX: 4.2.x, SunOS: 5.5, SunOS: 5.5.1 Type Unauthorized Access Attempt Vulnerability description Domain Name System (DNS) is a distributed database used to map IP addresses to host names. DNS responses containing an IP address value larger than 4 bytes will overflow internal buffers in a vulnerable gethostbyname() library function. Any program that uses the vulnerable function to perform DNS lookups may allow a remote attacker to execute arbitrary commands or gain root access on a targeted system. How to remove this vulnerability For AIX 3.2.x, 4.1.x, and 4.2.x: Apply the appropriate patch for your system, as listed in IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1997:001.1. See References. 93 Overflowing DNS IPv4 length allows attackers to gain access (DNS_Length_Overflow) For Solaris 2.5 (SunOS 5.5) and Solaris 2.5.1 (SunOS 5.5.1): Apply the appropriate patch for your system, as listed in Sun Microsystems, Inc. Security Bulletin #00137a. See References. References IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1996:007.1 Possible buffer overrun condition in "gethostbyname()" library function http://www-1.ibm.com/services/continuity/recover1.nsf/advisories/ 339C9BBFF919554A8525680F0077E2F3/$file/ERS-SVA-E01-1996_007_1.txt IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1996:007.2 Update of ERS-SVA-E01-1996:007.1 http://www-1.ibm.com/services/continuity/recover1.nsf/advisories/ 97E24C45F60272748525680F0077E307/$file/ERS-SVA-E01-1996_007_2.txt IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1997:001.1 Update of ERS-SVA-E01-1996:007.1 http://www-1.ibm.com/services/continuity/recover1.nsf/advisories/ F15B71C1AFF8A88A8525680F0077E2F4/$file/ERS-SVA-E01-1997_001_1.txt Sun Microsystems, Inc. Security Bulletin #00137a Revised security patches for Solaris 2.5 and 2.5.1 http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/ 137&type=0&nav=sec.sba Network Associates, Inc. COVERT Labs Security Advisory #01 Vulnerability in Unchecked DNS Data http://www.pgp.com/research/covert/advisories/001.asp CIAC Information Bulletin H-13 IBM AIX(r) Security Vulnerabilities (gethostbyname,lquerypv) http://ciac.llnl.gov/ciac/bulletins/h-13.shtml BugTraq Mailing List, Tue Jun 12 2001 11:40:20 rsh bufferoverflow on AIX 4.2 http://www.securityfocus.com/archive/1/190482 BugTraq Mailing List, Tue Jun 12 2001 12:02:50 Re: (forw) rsh bufferoverflow on AIX 4.2 http://www.securityfocus.com/archive/1/190630 ISS X-Force Overflowing DNS IPv4 length allows attackers to gain access http://xforce.iss.net/static/637.php CVE CVE-1999-0101 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0101 94 Microsoft DNS Server - Name offset exceeding DNS message packet length (dns_name_offset) Microsoft DNS Server - Domain name exceeding maximum packet length (dns_maxlen_pkt) About this signature or vulnerability This signature detects a Windows event log message indicating that a domain name exceeding the maximum packet length has been detected by Microsoft DNS Server. Default risk level High Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description Microsoft DNS Server encountered a domain name exceeding the maximum packet length. A domain name should never exceed the maximum length in the DNS message packet. This may indicate a remote DNS application error, or an attempt by an attacker to manipulate the DNS server. How to remove this vulnerability Investigate the origin of the invalid DNS packet. If the sending host is located inside the firewall, determine if any suspicious applications are running on the computer. Remove the host from the network if necessary. If the sending host is located outside the firewall, create a filter on the firewall to prevent bad packets from reaching the DNS server. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Microsoft DNS Server - Domain name exceeding maximum packet length http://xforce.iss.net/static/4637.php Microsoft DNS Server - Name offset exceeding DNS message packet length (dns_name_offset) About this signature or vulnerability This signature detects a Windows event log message indicating that a name offset exceeding the DNS message packet length has been detected by Microsoft DNS Server. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 95 BIND 8.2 and 8.2.1 remote buffer overflow in the processing of NXT records (DNS_NXT_Overflow) Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description Microsoft DNS Server encountered a DNS message with a name offset exceeding the packet length. The name offset of a valid DNS message should never exceed the packet length. An invalid name offset in the packet could be an indication of a remote DNS application error, or an attempt by an attacker to manipulate the DNS server. How to remove this vulnerability Investigate the origin of the invalid DNS packet. If the sending host is located inside the firewall, determine if any suspicious applications are running on the computer. Remove the host from the network if necessary. If the sending host is located outside the firewall, create a filter on the firewall to prevent bad packets from reaching the DNS server. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Microsoft DNS Server - Name offset exceeding DNS message packet length http://xforce.iss.net/static/4679.php BIND 8.2 and 8.2.1 remote buffer overflow in the processing of NXT records (DNS_NXT_Overflow) About this signature or vulnerability This signature detects a DNS packet containing a long rdata length, which may be an attempt to overflow a buffer in Bind’s NXT record processing code. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Red Hat Linux: 6.0, BIND: 8.2, BIND: 8.2 P1, BIND: 8.2.1 Type Unauthorized Access Attempt Vulnerability description BIND is a freely available DNS server produced by the Internet Software Consortium. BIND is vulnerable to a buffer overflow in the processing of NXT records in the 8.2 and 8.2.1 versions of BIND. A remote attacker can overflow this buffer and execute arbitrary code on vulnerable servers with root privileges. How to remove this vulnerability Upgrade to the latest version of BIND (8.2.2-P5 or later), available from the Internet Software Consortium Web site. See References. 96 BIND 8.2 and 8.2.1 remote buffer overflow in the processing of NXT records (DNS_NXT_Overflow) For Red Hat Linux: Upgrade to the latest version of BIND (8.2.2_P3-1 or later), as listed in Red Hat, Inc. Security Advisory RHSA-1999:054-01. See References. For Caldera OpenLinux: Upgrade to the latest version of BIND (8.2.2p3-1 or later), as listed in Caldera Systems, Inc. Security Advisory CSSA-1999:034.0. See References. For TurboLinux: Upgrade to the latest version of BIND (8.2.2P5-1 or later), available from the TurboLinux Web site. See References. For Hewlett-Packard: Apply the appropriate patch for your system (4.9.7 or later), as listed in Hewlett-Packard Security Bulletin HPSBUX0005-114. As an alternative, upgrade to the latest version of BIND (8.1.2 or later), as listed in Hewlett-Packard Security Bulletin HPSBUX0005-114. For SuSE Linux: Upgrade to the latest version of BIND 4 (4.9.7-101 or later), or BIND 8 (8-8.2.2-8 or later), as listed in SuSE Security Announcement #28. See References. For other distributions: Contact your vendor for upgrade or patch information. Red Hat Linux: 6.0 Upgrade to the latest version of bind (8.2.2_P3-1 or later), as listed in Red Hat Security Advisory RHSA-1999:054-01. References Internet Software Consortium (ISC) Web site BIND Vulnerabilities http://www.isc.org/products/BIND/bind-security-19991108.html CERT Advisory CA-1999-14 Multiple Vulnerabilities in BIND http://www.cert.org/advisories/CA-1999-14.html Red Hat Linux Errata Advisory RHSA-1999:054-01 Security problems in bind http://www.redhat.com/support/errata/RHSA1999054-01.html Caldera Systems, Inc. Security Advisory CSSA-1999-034.0 several vulnerabilities in bind http://www.calderasystems.com/support/security/advisories/CSSA-1999-034.0.txt CIAC Information Bulletin K-007 Multiple Vulnerabilities in BIND http://www.ciac.org/ciac/bulletins/k-007.shtml TurboLinux Security Updates bind-8.2.2P5-1.i386.rpm http://www1.turbolinux.com/security/ 97 BIND 8.2.x transaction signature (TSIG) buffer overflow (DNS_TSIG_Overflow) SuSE Security Announcement #28 Security hole in bind8 < 8.2.2p2 and bind4 < 4.9.7-REL http://www.suse.de/de/support/security/suse_security_announce_28.txt Hewlett-Packard Security Bulletin HPSBUX0005-114 Security vulnerability in the BIND executable http://us-support.external.hp.com/index.html CERT Vulnerability Note VU#16532 BIND T_NXT record processing may cause buffer overflow https://www.kb.cert.org/vuls/id/16532 Debian Security Announcement Mailing List Denial of service vulnerabilities in bind http://www.debian.org/security/1999/19991116 SCO System Security Enhancement (SSE) SSE033 System Security Enhancement (SSE) <SSE033> - 16 Nov 1999 ftp://ftp.sco.com/SSE/sse033.ltr CERT Advisory CA-2000-03 Continuing Compromises of DNS servers http://www.cert.org/advisories/CA-2000-03.html Internet Software Consortium (ISC) Web site BIND Vulnerabilities http://www.isc.org/products/BIND/bind-security-19991108.html ISS X-Force BIND 8.2 and 8.2.1 remote buffer overflow in the processing of NXT records http://xforce.iss.net/static/3476.php CVE CVE-1999-0833 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0833 BIND 8.2.x transaction signature (TSIG) buffer overflow (DNS_TSIG_Overflow) About this signature or vulnerability This signature detects a DNS packet of excessive length that contains a TSIG (Transaction SIGnature) resource record. This may indicate an attempt by an attacker overflow a buffer in the error handling code in some versions of the BIND (Berkeley Internet Name Daemon) server. If your network's DNS architecture is not utilizing RFC2845 TSIG authentication, this signature is highly indicative of an attack. Configurable Parameters: The length of the DNS packet that this signature detects can be configured in the Policy Editor for DNS_TSIG_Overflow. Default risk level 98 High BIND 8.2.x transaction signature (TSIG) buffer overflow (DNS_TSIG_Overflow) Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected FreeBSD, TurboLinux, SuSE Linux, Slackware Linux, Red Hat Linux: 5.2, BIND: 8.2, Caldera OpenLinux: 2.3, Red Hat Linux: 6.2, Debian Linux: 2.2, Mandrake Linux, Conectiva Linux, Caldera OpenLinux eDesktop: 2.4, Red Hat Linux: 7.0, Immunix OS: 6.2, Immunix OS: 7.0-beta, Caldera OpenLinux eServer: 2.3.1, Caldera OpenServer: 5.0.6a and earlier Type Unauthorized Access Attempt Vulnerability description ISC BIND (Berkeley Internet Name Daemon) is the most popular implementation of the DNS (Domain Name Server) protocol for Unix and Linux DNS servers. BIND versions 8.2 through 8.2.3-beta, including all patchlevels and interim releases, are vulnerable to a remotely exploitable buffer overflow in the code that handles Transaction Signatures (TSIG). Transaction Signatures are a method of providing transaction-level authentication for DNS requests defined in RFC2845. When a BIND server receives a request with a TSIG resource record that contains an invalid key, it will branch into an error processing function. This function fails to accurately determine the memory available to form a response to the client and the stack or heap space containing the buffer can be manipulated to execute arbitrary code. How to remove this vulnerability Upgrade to the latest version of ISC BIND 9 (9.1.0 or later) or BIND 8 (8.2.3 or later), available from the Internet Software Consortium Web page. See References. If possible, upgrading to BIND 9.1.0 or later is highly recommended. For Linux-Mandrake 6.0, 6.1, 7.0, 7.1, 7.2, and Corporate Server 1.0.1: Upgrade to the latest version of BIND (8.2.3-1 or later), as listed in Linux-Mandrake Security Update Advisory MDKSA-2001:017. See References. For Slackware Linux 7.1 and -current: Upgrade to the latest version of BIND (8.2.3 or later), as listed in Slackware Advisory1121. See References. For Immunix OS 6.2 and 7.0-beta: Upgrade to the latest version of BIND (8.2.3-0.6.x or later), as listed in Immunix OS Security Advisory IMNX-2001-70-001-01. See References. For Red Hat Linux 5.2: Upgrade to the latest version of BIND (8.2.3-0.5 or later), as listed in Red Hat, Inc. Red Hat Security Advisory RHSA-2001:007-03. See References. For Red Hat Linux 6.2: Upgrade to the latest version of BIND (8.2.3-0.6 or later), as listed in Red Hat, Inc. Red Hat Security Advisory RHSA-2001:007-03. See References. For Red Hat Linux 7.0: Upgrade to the latest version of BIND (8.2.3-1 or later), as listed in Red Hat, Inc. Red Hat Security Advisory RHSA-2001:007-03. See References. 99 BIND 8.2.x transaction signature (TSIG) buffer overflow (DNS_TSIG_Overflow) For Conectiva Linux 4.0, 4.0es, 4.1, 4.2, 5.0, prg gráficos, ecommerce, 5.1, 6.0: Upgrade to the latest version of BIND (8.2.3-1cl or later), as listed in Conectiva Linux Security Announcement CLA-2001:377. See References. For Caldera OpenLinux 2.3, 2.3.1, and 2.4: Upgrade to the latest version of BIND (8.2.3-1 or later), as listed in Caldera Systems, Inc. Security Advisory CSSA-2001-008.1. See References. For SuSE Linux 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, and 7.1: Upgrade to the latest version of BIND (8.2.3 or later), as listed in SuSE Security Announcement SuSE-SA:2001:03. See References. For Debian Linux 2.2 potato: Upgrade to the latest version of BIND (8.2.3-0 or later), as listed in Debian Security Advisory DSA-026-1. See References. For FreeBSD 3.x, 4.x, 3.5-STABLE, 4.2-STABLE: Upgrade to the latest version of BIND (8.2.3 or later), as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-01:18. See References. For NetBSD current, 1.4, 1.5: Upgrade to the latest version of BIND, as listed in NetBSD Security Advisory 2001-001. See References. For TurboLinux 6.0.5 and earlier: Upgrade to the latest version of BIND (8.2.3-2 or later), as listed in TurboLinux Security Announcement TLSA2001004-1. See References. References Network Associates, Inc. COVERT Labs Security Advisory #47 Vulnerabilities in BIND 4 and 8 http://www.pgp.com/research/covert/advisories/047.asp CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND http://www.cert.org/advisories/CA-2001-02.html Internet Software Consortium (ISC) Web site BIND Vulnerabilities http://www.isc.org/products/BIND/bind-security.html Internet Security Systems Security Alert #72 Remote Vulnerabilities in BIND versions 4 and 8 http://xforce.iss.net/alerts/advise72.php IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-2001:002.1 4 Vulnerabilities in BIND4 and BIND8 http://www.securityfocus.com/archive/1/160002 Linux-Mandrake Security Update Advisory MDKSA-2001:017 bind update http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-017.php3 Slackware Security Advisory-1121 multiple vulnerabilities in bind 8.x http://search.linuxsecurity.com/advisories/slackware_advisory-1121.html 100 BIND 8.2.x transaction signature (TSIG) buffer overflow (DNS_TSIG_Overflow) Immunix OS Security Advisory IMNX-2001-70-001-01 (from SecurityFocus Archive) bind http://www.securityfocus.com/advisories/3063 Red Hat Linux Errata Advisory RHSA-2001:007-03 Updated bind packages available http://www.redhat.com/support/errata/RHSA-2001-007.html Conectiva Linux Security Announcement CLA-2001:377 bind http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000377 Caldera Systems, Inc. Security Advisory CSSA-2001-008.1 BIND buffer overflow http://www.calderasystems.com/support/security/advisories/CSSA-2001-008.1.txt SuSE Security Announcement SuSE-SA:2001:03 bind8 http://www.suse.com/de/support/security/2001_003_bind8_txt.txt Debian Security Advisory DSA-026-1 buffer overflows and information leak http://www.debian.org/security/2001/dsa-026 FreeBSD, Inc. Security Advisory FreeBSD-SA-01:18 BIND remotely exploitable buffer overflow ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:18.bind.asc NetBSD Security Advisory 2001-001 (from SecurityFocus Archive) Multiple BIND vulnerabilities http://www.securityfocus.com/advisories/3091 TurboLinux Security Announcement TLSA2001004-1 [TL-Security-Announce] Bind-8.2.3-2 TLSA2001004-1 http://www.turbolinux.com/pipermail/tl-security-announce/2001-February/ 000034.html CERT Vulnerability Note VU#196945 ISC BIND 8 contains buffer overflow in transaction signature (TSIG) handling code https://www.kb.cert.org/vuls/id/196945 CIAC Information Bulletin L-030 Four Vulnerabilities in ISC BIND http://www.ciac.org/ciac/bulletins/l-030.shtml CIAC Information Bulletin L-127 Sun BIND Vulnerabilities http://www.ciac.org/ciac/bulletins/l-127.shtml Sun Microsystems, Inc. Security Bulletin #00204 BIND http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/ 204&type=0&nav=sec.sba 101 Zone transfer request for non-existent or non-authoritative zone (dns_unauth_xfer) Caldera International, Inc. Security Advisory CSSA-2001-SCO.13 OpenServer: BIND buffer overflows ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.13/CSSA-2001SCO.13.txt ISS X-Force BIND 8.2.x transaction signature (TSIG) buffer overflow http://xforce.iss.net/static/6015.php CVE CVE-2001-0010 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010 Zone transfer request for non-existent or non-authoritative zone (dns_unauth_xfer) About this signature or vulnerability This signature detects a Windows event log message indicating that Microsoft DNS Server has received a DNS zone transfer request for a non-existent or non-authoritative zone. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description DNS zone transfer requests can only be honored by a DNS server if the DNS server is authoritative for the domain ("zone") requested. DNS zone transfer requests for nonexistent or non-authoritative zones rarely occur in a production DNS environment, and could be the result of a remote DNS application error, or an attempt by an attacker to retrieve DNS zone information. How to remove this vulnerability Investigate the origin and purpose of the zone transfer request. If the sending host is located inside the firewall, determine if any suspicious applications are running on the system. Remove the host from the network if necessary. If the sending host is located outside the firewall, create a filter on the firewall to prevent bad packets from reaching the DNS server. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Zone transfer request for non-existent or non-authoritative zone http://xforce.iss.net/static/4666.php 102 Microsoft DNS Server - DNS honors zone transfer requests (DNS_Zone_Transfer) Microsoft DNS Server - DNS Zone Transfers from high ports (DNS_Zone_High_Port) About this signature or vulnerability This signature detects a zone transfer originating from a non-privileged port number (above 1024). Default risk level Low Sensors that have this signature RealSecure Network Sensor: 2.5 Systems affected DNS Type Pre-attack Probe Vulnerability description A DNS zone transfer that originates from a non-privileged port number (above 1024) suggests that the zone transfer is occurring between your DNS server and a DNS client program, such as nslookup. Zone transfers contain a list of the systems on your network. Such information could be useful to an attacker in performing an attack. How to remove this vulnerability Observe the source address, and watch for additional events originating at that address. Configure your DNS server to disallow zone transfers from systems other than the peer DNS servers it must participate with, or at least from non-privileged port numbers. If it is a standalone DNS server, disallow zone transfers entirely. References ISS X-Force Microsoft DNS Server - DNS Zone Transfers from high ports http://xforce.iss.net/static/1226.php Microsoft DNS Server - DNS honors zone transfer requests (DNS_Zone_Transfer) About this signature or vulnerability This signature detects a zone transfer being made between your DNS server and what may well be another DNS server. The source port of the request is a privileged port number (below 1024) indicating another server possibly made the request. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 6.5 Systems affected Any Type Pre-attack Probe 103 Doly backdoor for Windows (Doly) Vulnerability description Zone transfers contain lists that identify every computer registered with the DNS server. This information could be useful to an attacker in performing an attack. If the source port of the DNS zone transfer request is a privileged port number (below 1024), it could indicate that another DNS server has made the request. How to remove this vulnerability If your DNS server should not be participating in zone transfers, configure your DNS server to prevent zone transfers. Refer to your DNS server's documentation for details. References ISS X-Force Microsoft DNS Server - DNS honors zone transfer requests http://xforce.iss.net/static/212.php Doly backdoor for Windows (Doly) About this signature or vulnerability This signature detects a TCP connection on port 1015 to a Doly backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Doly backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Doly backdoor, an attacker can do the following: How to remove this vulnerability ● log your keystrokes ● start an FTP server ● capture an image of your screen ● shut down or restart your computer To remove the Doly backdoor from your computer: 1. Using Regedit, find the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key. 2. Find the registry entry named Ms tesk that has a data value of C:\Program Files\Mdm.exe. 3. Delete this registry entry. 4. Delete Mdm.exe from C:\Program Files. 104 Donald Dick backdoor for Windows (DonaldDick) 5. Delete Mdm.exe from the Startup folder in the Windows Start menu. Go to Start -> Programs -> Startup. Right-click Mdm.exe and select Delete from the pop-up menu. References ISS X-Force Doly backdoor for Windows http://xforce.iss.net/static/3130.php Donald Dick backdoor for Windows (DonaldDick) About this signature or vulnerability This signature detects a TCP connection on port 23476 to a Donald Dick backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Donald Dick backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Donald Dick backdoor, an attacker can do the following: How to remove this vulnerability ● access your files and system registry ● retrieve screensaver and BIOS passwords ● access program windows ● restart or shutdown your computer ● send messages to you that appear on your screen To remove the Donald Dick backdoor from your computer, follow the instructions for your operating system: For Windows 95 or 98: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the HKLM\System\CurrentControlSet\Service\VxD\VMLDR registry key. It should contain a registry entry named StaticVxD that has a data value of vmldr.vxd. 2. Delete the entire VMLDR registry key and all of its values. 3. Delete the following files from C:\Windows\System: 105 Desktop Protection System Server reported a critical event (DPS_Server_Critical_Event) ■ oleproc.exe ■ vmldr.vxd ■ jpegcomp.dll For Windows NT: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Open Regedt32. (From the Start menu, click Run. Type regedt32, and then click OK.) 2. Using Regedt32, find the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager registry key. 3. Find the registry entry named BootExecute. 4. Double-click this registry entry. A list of programs is shown. 5. Find and delete the text "bootexec". Be careful not to delete any other characters from this list. 6. Click OK, and then close the Registry Editor. 7. Delete the following files from C:\WINNT\system32: ■ oleproc.exe ■ bootexec.exe ■ jpegcomp.dll 8. Restart your computer. References Donald Dick Official Web site Last News http://donalddick.da.ru/ ISS X-Force Donald Dick backdoor for Windows http://xforce.iss.net/static/4148.php Desktop Protection System Server reported a critical event (DPS_Server_Critical_Event) About this signature or vulnerability This event detects a Windows Application event log message written by the DPS Server when an internal problem is detected. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Windows 2000 106 Stack overflow error reported by Dr. Watson diagnostic tool (drw_stack_ovflw) Type Host Sensor Vulnerability description Desktop Protection System Server reported a critical event that may have rendered it inoperable. This could include a full database or a full or expired license key, either of which would cause the server to no longer process incoming sensor data. How to remove this vulnerability Locate the Desktop Protection System host on which the event was detected. Use the Desktop Protection System Management Console and documentation to determine the cause of the problem and how to correct it. References ISS X-Force Desktop Protection System Server reported a critical event http://xforce.iss.net/static/6120.php Stack overflow error reported by Dr. Watson diagnostic tool (drw_stack_ovflw) About this signature or vulnerability This signature detects a Windows event log message indicating a stack overflow error. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description Dr. Watson is a diagnostic tool for Windows NT and Windows 2000 that records system information when a system fault occurs. Dr. Watson intercepts software faults, identifies the software that faulted, and offers a detailed description of the cause. When Dr. Watson reports a stack overflow error with a failing application, it may indicate problems with the application. How to remove this vulnerability Examine the Dr. Watson log file. Investigate the cause of application failure. Restart the failing application if necessary. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Stack overflow error reported by Dr. Watson diagnostic tool http://xforce.iss.net/static/4669.php 107 Echo service (Echo_Denial_of_Service) Echo service (Echo_Denial_of_Service) Additional Vulnerabilities Found ■ udp-dos Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected Any Type Denial of Service Vulnerability description The echo service was detected as running. The echo (port 7) service can be spoofed into sending data from one service on one computer to another service on another computer. This action causes an infinite loop and creates a denial of service attack. The attack can consume increasing amounts of network bandwidth, causing loss of performance or a total shutdown of the affected network segments. The attack can also disable your Unix server by causing it to spend all its time processing packets that it's echoed back to itself. How to remove this vulnerability Disable the echo service if it is not being used. Unix: Disable the echo service by commenting out the echo entry in the /etc/inetd.conf file, then restarting the inetd process. Windows: The echo service is not native to Windows, but may be present. To disable this service: 1. Open the Services control panel. From the Windows NT Start menu, select Settings --> Control Panel and Services. 2. Select the Simple TCP/IP Services service and click Stop. 3. Click Startup. 4. To permanently stop all TCP/IP services, click Disabled. — OR — If you only want to disable the echo service: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Open the registry editor. From the Windows NT Start menu, select Run. Type regedt32 and click OK. 2. Select the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SimpTcp\Parame ters key. 108 ALMail POP3 overflow in SMTP processing code (Email_Almail_Overflow) 3. Set EnableTcpEcho and EnableUdpEcho to 0. 4. Restart the Simple TCP/IP service. Novell: Disable the echo port as described in Novell Technical Information Document #2946023: 1. Install NIAS4.0 or later. 2. Load INETCFG —> Protocols —> TCP/IP, and set filter support to ENABLED. 3. Load FILTCFG —> TCP/IP —> Packet Forwarding filters, and set the status to ENABLED. 4. Verify that the action is Deny packets in filter list. Press ENTER on '(Filters: list of denied packets)'. 5. Press INSERT go to packet type: Name: <all>. 6. Press ENTER, find the port echo TCP 7. 7. Press ENTER, ESCAPE, save filters: YES. References CERT Advisory CA-1996-01 UDP Port Denial-of-Service Attack http://www.cert.org/advisories/CA-1996-01.html Novell Technical Information Document #2946023 TCPIP blocking ports (7, 9, 19, etc) http://support.novell.com/cgi-bin/search/tidfinder.cgi?2946023 ISS X-Force Echo service http://xforce.iss.net/static/44.php CVE CVE-1999-0103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0103 ALMail POP3 overflow in SMTP processing code (Email_Almail_Overflow) About this signature or vulnerability This signature detects a long SMTP header directed at the ALMail POP3 client. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: SR 1.1, RealSecure Server Sensor: 5.5.2 Systems affected ALMail pop3 Server Type Unauthorized Access Attempt 109 AMaViS virus scanner allows arbitrary command execution as root (Email_Amavis_Exec) Vulnerability description The ALMail POP3 client is vulnerable to a buffer overflow in the code that parses the SMTP headers. By sending mail with long FROM, TO, or REPLY-TO headers, an attacker can overflow a buffer and execute arbitrary code. How to remove this vulnerability No remedy available as of September 2000. References Shadow Penguin Security AL-Mail32 Version 1.10 Exploit for Windows98 http://shadowpenguin.backsection.net/advisories/old/ex_almail.c ISS X-Force ALMail POP3 overflow in SMTP processing code http://xforce.iss.net/static/3541.php CVE CAN-1999-0673 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0673 AMaViS virus scanner allows arbitrary command execution as root (Email_Amavis_Exec) About this signature or vulnerability This signature detects SMTP "MAIL FROM" commands containing specific characters, which could indicate an attempt by an attacker to execute arbitrary commands on the system by sending specially-crafted emails. False negatives RealSecure Network Sensor: A false negative is possible if an attacker includes a pipe character ("|") in the exploit. In this case, RealSecure may incorrectly report the occurence of an smtppipe attack. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.3 Systems affected AMaViS Virus Scanner: 0.2pre-4 Type Suspicious Activity Vulnerability description AMaViS is an email virus scanner for Linux systems. AMaViS version 0.2.0Pre-4 could allow a remote attacker to execute arbitrary commands on the victim system by sending a virus-infected email containing specially-crafted headers to a system protected by AMaViS. When the AMaViS scanner attempts to reply to the originator of the infected email, arbitrary commands from the email can be executed with the privileges of the user receiving the email. How to remove this vulnerability Upgrade to the latest version of AmaVis (0.2.0-pre5 or later), available from the AMaVis Web site. See References. 110 SMTP in debug mode (Email_Debug) References BugTraq Mailing List, Fri Jul 16 1999 17:00:43 AMaViS virus scanner for Linux - root exploit http://www.securityfocus.com/archive/1/18755 AMaViS Web site AMaViS http://aachalon.de/AMaViS/ ISS X-Force AMaViS virus scanner allows arbitrary command execution as root http://xforce.iss.net/static/2349.php CVE CAN-1999-1512 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1512 SMTP in debug mode (Email_Debug) False positives RealSecure Network Sensor: It is possible that an e-mail with the word "debug" in the line could appear to be this vulnerability. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Sendmail: Old Versions Type Unauthorized Access Attempt Vulnerability description Sendmail was found in debug mode. Debug mode allows an attacker to gain access to a computer through the Sendmail port. This option looks for old versions of Sendmail that allow debug mode and could provide an attacker access to the computer. An attacker could use debug mode to initiate a root-level shell on the target host. How to remove this vulnerability Upgrade to the latest version of sendmail (5.59 or later), which does not implement the DEBUG feature, as listed in CERT Advisory CA-1988-01. See References. References CERT Advisory CA-1993-14 Internet Security Scanner (ISS) http://www.cert.org/advisories/CA-1993-14.html Sendmail Consortium Web site Sendmail Homepage http://www.sendmail.org CERT Advisory CA-1988-01 ftpd vulnerability http://www.cert.org/advisories/CA-1988-01.html 111 Sendmail decode/uudecode alias could allow remote file creation (Email_Decode) ISS X-Force SMTP in debug mode http://xforce.iss.net/static/125.php CVE CVE-1999-0095 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0095 Sendmail decode/uudecode alias could allow remote file creation (Email_Decode) Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 Systems affected Unix, Sendmail Type Unauthorized Access Attempt Vulnerability description A common configuration for older mail transfer agents (MTAs) is to include an alias for the decode user. All mail sent to this user is sent to the uudecode program, which automatically converts and stores files. A remote attacker can send mail to the decode or uudecode alias that is present on some systems to create or overwrite files on the remote host. This allows an attacker to gain remote access to the system. How to remove this vulnerability Disable mail aliases for decode and uudecode. If the /etc/aliases or /usr/lib/aliases (mail alias) file contains entries for these programs, remove them or disable them by placing # at the beginning of the line, and then executing the newaliases command. For more information on Unix mail aliases, refer to the man page for aliases. Disabled aliases would be similar to these examples: # decode: |/usr/bin/uudecode # uudecode: |/usr/bin/uuencode -d References CIAC Information Bulletin A-14 Additional information on the vulnerability in the UNIX DECODE alias http://www.ciac.org/ciac/bulletins/a-14.shtml CIAC Information Bulletin A-13 Vulnerability in DECODE alias http://www.ciac.org/ciac/bulletins/a-13.shtml Sun Microsystems, Inc. Security Bulletin #00122 New security patches for tar and sendmail http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/ 122&type=0&nav=sec.sba 112 SMTP daemon supports EHLO (Email_Ehlo) ISS X-Force Sendmail decode/uudecode alias could allow remote file creation http://xforce.iss.net/static/126.php CVE CVE-1999-0096 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0096 SMTP daemon supports EHLO (Email_Ehlo) Default risk level Low Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected SMTP servers Type Unauthorized Access Attempt Vulnerability description SMTP daemons that support Extended HELO (EHLO) can release information that could be useful to an attacker in performing an attack. Attackers have been known to use the EHLO command to determine configuration information on SMTP daemons. Internet Scanner users: This check may crash a Dmail Manager if the Dmail Manager is on a subdomain. How to remove this vulnerability Extended SMTP provides some useful features that basic SMTP does not support. However, if you are uncomfortable with the information that the Extended SMTP features can reveal, you may choose to disable EHLO on your mail server. Consult your mail server documentation or contact your vendor for information on how to modify your mail server configuration to disable EHLO. References Microsoft Exchange 5.5 Product Documentation Disabling ESMTP Support http://www.microsoft.com/Exchange/en/55/help/default.asp?url=/Exchange/en/ 55/help/documents/server/XOG05031.HTM ISS X-Force SMTP daemon supports EHLO http://xforce.iss.net/static/323.php CVE CAN-1999-0531 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0531 113 Exchange Server Information Store (store.exe) denial of service (Email_ExchangeStore_DoS) Exchange Server Information Store (store.exe) denial of service (Email_ExchangeStore_DoS) About this signature or vulnerability This signature detects an email containing a specially-crafted MIME header, which could indicate an attacker's attempt to cause the Information Store service to fail and crash the Exchange Server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Server Sensor: 6.5 Systems affected Windows NT: 4.0, Microsoft Exchange: 5.5 Type Denial of Service Vulnerability description Microsoft Exchange Server version 5.5 is vulnerable to a denial of service attack caused by a vulnerability in the Information Store service (store.exe). An attacker can send an email with malformed MIME headers containing "" in the boundary field to cause the Information Store service to fail and crash the Exchange Server. The service must be stopped, and the email must be removed before restarting the service. How to remove this vulnerability Apply the latest Service Pack available for Exchange 5.5 (Service Pack 4 or later). — OR — Apply the patch for this vulnerability, as listed in Microsoft Security Bulletin MS00-082. See References. References BugTraq Mailing List, Tue Sep 12 2000 08:30:48 Possible Exchange 5.5 Server DoS http://www.securityfocus.com/archive/1/82334 Microsoft Security Bulletin MS00-082 Patch Available for "Malformed MIME Header" Vulnerability http://www.microsoft.com/technet/security/bulletin/ms00-082.asp Microsoft Security Bulletin MS00-082 FAQ Microsoft Security Bulletin (MS00-082): Frequently Asked Questions http://www.microsoft.com/technet/security/bulletin/fq00-082.asp Microsoft Knowledge Base Article Q275714 XADM: Information Store Stops Unexpectedly with Multipart or Mixed Message and Null Boundary String http://www.microsoft.com/technet/support/kb.asp?ID=275714 ISS X-Force Exchange Server Information Store (store.exe) denial of service http://xforce.iss.net/static/5265.php 114 SMTP EXPN command (Email_Expn) CVE CAN-2000-1006 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1006 SMTP EXPN command (Email_Expn) Additional Vulnerabilities Found ■ smtp-sendmail-version5 ■ slmail-vrfyexpn-overflow False positives RealSecure Network Sensor: EXPN is a valid command, and false positive is possible for legitimate use of the EXPN command. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected SMTP servers, Solaris: 2.5.1, Solaris: 2.6, HP-UX: 10.20, Solaris: 7, Red Hat Linux: 6.0, Solaris: 8, AIX: 4.0, HP-UX: 11, Compaq: Tru64 UNIX Type Pre-attack Probe Vulnerability description Simple Mail Transfer Protocol (SMTP)-compliant applications, such as the Sendmail program EXPN, could allow an attacker to determine if an account exists on a system. Such information could provide an attacker significant assistance in executing a brute force attack on user accounts. EXPN provides additional information concerning users on the system, such as if particular users exist and users' full names. This information could also assist an attacker in further attacks. How to remove this vulnerability If you are running Sendmail, add the line 'Opnoexpn' to your Sendmail configuration file, usually located in /etc/sendmail.cf. For other mail servers, contact your vendor for information on how to disable the expand command. —AND— Upgrade to the latest version of Sendmail (8.11.4 or later), available from the Sendmail Consortium Web site. See References. —OR— Apply the appropriate patch for your system, available from the Sendmail Consortium FTP site. See References. Solaris: 2.5.1 Add the option 'Opnoexpn' to the sendmail.cf file. Solaris: 2.6 115 SMTP EXPN command (Email_Expn) Add the option 'Opnoexpn' to the sendmail.cf file. HP-UX: 10.20 Add the option 'Opnoexpn' to the sendmail.cf file. Solaris: 7 Add the option 'Opnoexpn' to the sendmail.cf file. Red Hat Linux: 6.0 Add the option 'Opnoexpn' to the sendmail.cf file. Solaris: 8 Add the option 'Opnoexpn' to the sendmail.cf file. AIX: 4.0 Add the option 'Opnoexpn' to the sendmail.cf file. HP-UX: 11 Add the option 'Opnoexpn' to the sendmail.cf file. Compaq: Tru64 UNIX If you are running Sendmail, add the line Opnoexpn to your Sendmail configuration file, usually located in /etc/sendmail.cf. For other mail servers, contact your vendor for information on how to disable the expand command. Upgrade to the latest version of Sendmail (8.11.4 or later), available from the Sendmail Consortium Web site. See References. --OR-- Apply the appropriate patch for your system, available from the Sendmail Consortium FTP site. References Sendmail Consortium Web site Welcome to sendmail.org http://www.sendmail.org/ Sendmail Consortium FTP site FTP site ftp://ftp.cs.berkeley.edu/ucb/sendmail/ ISS X-Force SMTP EXPN command http://xforce.iss.net/static/128.php CVE CAN-1999-0531 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0531 116 SMTP EXPN buffer overflow can crash or obtain access (Email_Expn_Overflow) SMTP EXPN buffer overflow can crash or obtain access (Email_Expn_Overflow) Additional Vulnerabilities Found ■ smtp-sendmail-version5 ■ slmail-vrfyexpn-overflow Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected SMTP servers, SLMail: v2.6 and earlier, Mercury Mail Server, AppleShare IP Mail Server Type Suspicious Activity Vulnerability description Several freeware, shareware, and commercial SMTP servers contain buffer overflows. Different SMTP commands can cause the SMTP server to crash or to execute arbitrary byte-code that could lead to a system compromise. For example, the Seattle Lab SLMail SMTP server contains overflows in the VRFY and EXPN commands. AppleShare, Stalker, and Mercury SMTP servers contain overflows in the HELO command as well. Other lesser-known SMTP servers may also contain overflows. How to remove this vulnerability Determine if your SMTP server is vulnerable to the attack and take appropriate actions depending on the extent of your vulnerability. Manually test for this vulnerability by connecting to port 25 on your computer and sending the appropriate command (HELO, VRFY, or EXPN) followed by at least 1024 X's. If the SMTP server returns an OK or an error message, then you are not vulnerable. If your connection closes immediately, then the system is most likely vulnerable. If your system is vulnerable, then it may have already been compromised. If the attack was a denial of service attack, restart your SMTP server. Watch for further attacks from the source address. If your system is not vulnerable, then you have not been compromised, but the attack may be a sign of an attacker probing your network for vulnerabilities. References BugTraq Mailing List, Wed Mar 11 1998 17:44:56 SLMail 2.6 DoS http://www.securityfocus.com/archive/1/8748 BugTraq Mailing List, Wed Apr 08 1998 04:10:25 smtp overflows http://www.securityfocus.com/archive/1/8947 BugTraq Mailing List, Wed Apr 08 1998 13:34:09 Re: AppleShare IP Mail Server http://www.securityfocus.com/archive/1/8951 117 SMTP HELO buffer overflow can crash or obtain access (Email_Helo_Overflow) BugTraq Mailing List, Wed Apr 08 1998 18:11:17 AppleShare IP Mail Server http://www.securityfocus.com/archive/1/8952 Seattle Labs, Inc. Web site SLMAIL http://www.seattlelab.com/index.asp?page=http://www.seattlelab.com/slmail/* ISS X-Force SMTP EXPN buffer overflow can crash or obtain access http://xforce.iss.net/static/888.php CVE CAN-1999-0531 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0531 Email From (Email_From) About this signature or vulnerability This signature records the sender of an SMTP email message by looking for SMTP MAIL FROM: messages. In combination with other email signatures, this signature can construct a log of all email activity, including date, time, usernames, and the subject of the message. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 Systems affected SMTP servers Type Protocol Signature Vulnerability description The Simple Mail Transfer Protocol (SMTP) uses specific commands to transfer mail. The MAIL FROM: field identifies the user on the sending system. How to remove this vulnerability This activity can be examined for compliance with acceptable use policies, or for suspicion of unauthorized disclosure of sensitive information. References ISS X-Force Email From http://xforce.iss.net/static/643.php SMTP HELO buffer overflow can crash or obtain access (Email_Helo_Overflow) Additional Vulnerabilities Found 118 ■ smtp-exchangedos ■ slmail-helo-overflow ■ mailmax-bo SMTP HELO buffer overflow can crash or obtain access (Email_Helo_Overflow) ■ lotus-notes-helo-crash ■ mdaemon-helo-bo Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected SMTP servers, SLMail: v2.6 and earlier, Mercury Mail Server, AppleShare IP Mail Server Type Suspicious Activity Vulnerability description Several freeware, shareware, and commercial SMTP servers contain buffer overflows. Different SMTP commands can cause the SMTP server to crash or to execute arbitrary byte-code that could lead to a system compromise. For example, the Seattle Lab SLMail SMTP server software contains overflows in the VRFY and EXPN commands. AppleShare, Stalker, and Mercury SMTP servers contain overflows in the HELO command as well. Other lesser-known SMTP servers may also contain overflows. How to remove this vulnerability Determine if your SMTP server is vulnerable to the attack and take appropriate actions depending on the extent of your vulnerability. Manually test for this vulnerability by connecting to port 25 on your computer and sending the appropriate command (HELO, VRFY, or EXPN), followed by at least 1024 X's. If the SMTP server returns an OK or an error message, then you are not vulnerable. If your connection closes immediately, then the system is most likely vulnerable. If your system is vulnerable, then it may have already been compromised. If the attack was a denial of service attack, restart your SMTP server. Watch for further attacks from the source address. If your system is not vulnerable, then you have not been compromised, but the attack may be a sign of an attacker probing your network for vulnerabilities. References BugTraq Mailing List, Wed Mar 11 1998 17:44:56 SLMail 2.6 DoS http://www.securityfocus.com/archive/1/8748 BugTraq Mailing List, Wed Apr 08 1998 04:10:25 smtp overflows http://www.securityfocus.com/archive/1/8947 BugTraq Mailing List, Wed Apr 08 1998 13:34:09 Re: AppleShare IP Mail Server http://www.securityfocus.com/archive/1/8951 BugTraq Mailing List, Wed Apr 08 1998 18:11:17 AppleShare IP Mail Server http://www.securityfocus.com/archive/1/8952 Seattle Labs, Inc. Web site SLmail Overview http://www.seattlelabs.com/slmail/ 119 Listserv buffer overflow allows execution of arbitrary code (Email_Listserv_Overflow) ISS X-Force SMTP HELO buffer overflow can crash or obtain access http://xforce.iss.net/static/886.php CVE CAN-1999-1504 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1504 Listserv buffer overflow allows execution of arbitrary code (Email_Listserv_Overflow) About this signature or vulnerability This signature detects a buffer overflow attack against the Listserv mailing list management software. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 Systems affected Listserv Type Unauthorized Access Attempt Vulnerability description Listserv is a publicly available software package for managing mailing lists. Some versions of Listserv are vulnerable to a buffer overflow. By sending a specially crafted email to the listserv process, a remote attacker can overflow the buffer and execute arbitrary code on the system on which Listserv is running, or crash the system. How to remove this vulnerability This vulnerability does not exist in the commercial ListServ package distributed by L-Soft. Upgrade to the latest version of ListServ, available from the L-Soft Web site. See References. References BugTraq Mailing List, Fri Jun 20 1997 10:03:11 listserv buffer overflow(s) http://www.securityfocus.com/archive/1/7053 L-Soft Web site E-Mail List Management Software and Hosting Services - L-Soft http://www.lsoft.com/ ISS X-Force Listserv buffer overflow allows execution of arbitrary code http://xforce.iss.net/static/617.php CVE CVE-1999-0252 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0252 120 Microsoft Outlook date header buffer overflow (Email_Outlook_Date_Overflow) Microsoft Outlook date header buffer overflow (Email_Outlook_Date_Overflow) About this signature or vulnerability The Email_Outlook_Date_Overflow signature detects SMTP server traffic containing a "Date:" line longer than 150 characters. Configurable Parameters: The length of the "Date:" line this signature detects can be configured in the Policy Editor for Email_Outlook_Date_Overflow. False positives RealSecure Network Sensor: A false positive is possible if any line in an email sent by SMTP contains the text "Date:" and is 150 characters long. RealSecure Server Sensor: A false positive is possible if any line in an email sent by SMTP contains the text "Date:" and is 70 characters long. Default risk level High Sensors that have this signature RealSecure Network Sensor: SR 1.1, RealSecure Server Sensor: 5.5.2 Systems affected Windows NT, Microsoft Outlook: 98, Microsoft Outlook Express: 5.0, Windows 2000, Microsoft Outlook Express: 4.0, Microsoft Outlook: 2000, Microsoft Outlook: 97 Type Unauthorized Access Attempt Vulnerability description Microsoft Outlook and Microsoft Outlook Express are vulnerable to a buffer overflow in the inetcomm.dll component shared by both programs. By sending an email message with a long date header value, using either the POP3 or IMAP4 protocols, a remote attacker can overflow the buffer and execute arbitrary code on the system. The user does not have to open the message for the attack to be successful. A malicious email can begin executing code when it is retrieved from the server, before the user previews or opens the message. Only the POP3 and IMAP4 Internet email protocols are affected by this vulnerability. Microsoft Outlook also supports the MAPI (Microsoft Messaging API), the protocol used by Microsoft Exchange. Outlook users who retrieve mail using MAPI, and do not use either POP3 and IMAP4, are not affected by this vulnerability. How to remove this vulnerability For Internet Explorer 5.01: Apply the critical security patch, as listed in Microsoft Security Bulletin MS00-043. See References. For all other versions of Internet Explorer: Upgrade to Internet Explorer 5.01 Service Pack 1 or Internet Explorer 5.5, as listed in Microsoft Security Bulletin MS00-043. See References. (Windows 2000 users: Upgrading to Internet Explorer 5.5 does not correct this vulnerability on Windows 2000 systems.) Windows NT Apply the "Malformed E-mail Header" patch detailed in Microsoft Security Bulletin MS00-043 121 Sendmail pipe attack (Email_Pipe) Windows 2000 Apply the "Malformed E-mail Header" patch detailed in Microsoft Security Bulletin MS00-043 References Microsoft Security Bulletin MS00-043 Patch Available for 'Malformed E-mail Header' Vulnerability http://www.microsoft.com/technet/security/bulletin/MS00-043.asp Internet Security Systems Security Alert #57 Buffer Overflow in Microsoft Outlook and Outlook Express Mail Clients http://xforce.iss.net/alerts/advise57.php Underground Security Systems Research advisory USSR-2000050 Remotely Exploitable Buffer Overflow in Outlook 'Malformed E-mail MIME Header' Vulnerability http://www.ussrback.com/labs50.html Microsoft TechNet Microsoft Security Bulletin (MS00-043):Frequently Asked Questions http://www.microsoft.com/technet/security/bulletin/fq00-043.asp Microsoft Knowledge Base Article Q267884 E-mail Security Vulnerability Fixed in Internet Explorer 5.01 SP1 http://www.microsoft.com/technet/support/kb.asp?ID=267884 CIAC Information Bulletin K-060 Microsoft's Malformed E-Mail Header Vulnerability http://www.ciac.org/ciac/bulletins/k-060.shtml ISS X-Force Microsoft Outlook date header buffer overflow http://xforce.iss.net/static/4953.php CVE CVE-2000-0567 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0567 Sendmail pipe attack (Email_Pipe) False positives RealSecure Network Sensor: Some e-mail messages that contains a pipe character could possibly appear to be this attack. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Sendmail: Old Versions Type Unauthorized Access Attempt 122 Qmail long SMTP command denial of service (Email_Qmail_Length) Vulnerability description By inserting a pipe character into certain fields in an email, Sendmail may be forced to execute a command on the remote computer. This behavior may result in a remote attacker being able to execute commands and gain root access. How to remove this vulnerability Upgrade to the latest version of Sendmail (8.11.4 or later), available from the Sendmail Consortium Web site. See References. — OR — Apply the appropriate patch for your system, available from the Sendmail Consortium FTP site. See References. References Sendmail Consortium Web site Sendmail FAQ http://www.sendmail.org/faq Sendmail Consortium FTP site FTP site ftp://ftp.cs.berkeley.edu/ucb/sendmail/ ISS X-Force Sendmail pipe attack http://xforce.iss.net/static/616.php CVE CAN-1999-0565 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0565 Qmail long SMTP command denial of service (Email_Qmail_Length) About this signature or vulnerability This signature detects an extremely long string (greater than 8000 characters) in an SMTP command sent to a Qmail server. False positives RealSecure Network Sensor: It is possible that a very large email on a single line will trigger this signature, but not represent an attack. RealSecure Server Sensor: It is possible that a very large e-mail on a single line will trigger this signature, but not represent an attack. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 Systems affected Qmail: 1.01 and earlier Type Denial of Service 123 Qmail email RCPT denial of service (Email_Qmail_Rcpt) Vulnerability description The Qmail server is vulnerable to a denial of service attack. An attacker can include an extremely long string in an SMTP command sent to a qmail server to consume all memory resources on the server and cause the server to crash. How to remove this vulnerability Upgrade to the latest version of qmail (1.03 or later), available from the qmail Web site. See References. References Qmail Web site qmail: a replacement for sendmail http://www.qmail.org/top.html ISS X-Force Qmail long SMTP command denial of service http://xforce.iss.net/static/207.php Qmail email RCPT denial of service (Email_Qmail_Rcpt) About this signature or vulnerability This signature detects a message with an extremely large number of recipients (RCPTs) directed at the Qmail server. False positives RealSecure Network Sensor: It is possible that a single email with a large number of recipients (in excess of 65535) will trigger this signature, but not be an attack. This can be useful in detecting spam e-mail sent to your site. RealSecure Server Sensor: It is possible that a very large e-mail on a single line will trigger this signature, but not represent an attack. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected Qmail: 1.01 and earlier Type Denial of Service Vulnerability description The qmail server is vulnerable to a denial of service attack. By configuring the ‘Threshold’ advanced parameter, an attacker can adjust the number of RCPTs that are legitimately allowed in a session. The default value for this parameter is 65535. An attacker can send an RCPT command with an extremely large number of recipients to the Qmail server to consume all memory resources on the server and crash the server. How to remove this vulnerability Upgrade to the latest version of qmail (1.03 or later), available from the qmail Web site. See References. References Qmail Mailing List qmail-dos-2.c, another denial of service attack http://www.ornl.gov/its/archives/mailing-lists/qmail/1997/06/msg00322.html 124 Third-party mail relaying can be used to obfuscate the origin of emails (Email_Relay_Spam) Qmail Web site qmail: a replacement for sendmail http://www.qmail.org/top.html ISS X-Force Qmail email RCPT denial of service http://xforce.iss.net/static/208.php Third-party mail relaying can be used to obfuscate the origin of emails (Email_Relay_Spam) Additional Vulnerabilities Found ■ smtp-relay-uucp Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5.2 Systems affected Sendmail, SMTP servers Type Suspicious Activity Vulnerability description Some SMTP servers support third-party or %style mail relaying. Third-party mail relaying occurs when a mail server processes a mail message where neither the sender nor the recipient is local to the server's mail domain. While third party relaying has some legitimate purposes, such as allowing mail messages to be routed around known mail problems, email hijackers (or spammers) primarily use it to obscure their identity while sending large amounts of junk mail. How to remove this vulnerability Reconfigure your SMTP server to enforce that all mail messages must either originate or terminate locally (on the mail host). Information on how to secure your mail system against relaying is available from the "How Can I Fix the Problem?" document listed in the references. References Sendmail Consortium Web site Anti-Spam Provisions in Sendmail 8.8 http://www.sendmail.org/antispam.html Mail Abuse Protection System (MAPS) MAPS, LLC home page http://maps.vix.com Scott Hazen Mueller Web site Fight Spam on the Internet! http://spam.abuse.net/ 125 Email to (Email_To) Anti-Relay: Stop Third-Party Mail Relay How Can I Fix the Problem? http://mail-abuse.org/tsi/ar-fix.html CIAC Information Bulletin I-005c E-Mail Spamming countermeasures: Detection and prevention of E-Mail spamming http://www.ciac.org/ciac/bulletins/i-005c.shtml ISS X-Force Third-party mail relaying can be used to obfuscate the origin of emails http://xforce.iss.net/static/210.php CVE CAN-1999-0512 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0512 Email subject (Email_Subject) About this signature or vulnerability This signature records the subject of an SMTP email message by looking for SMTP SUBJECT: messages. In combination with the other email signatures, this signature can construct a log of all email activity, including date, time, usernames, and the subject of the message. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 Systems affected SMTP servers Type Protocol Signature Vulnerability description The Simple Mail Transfer Protocol (SMTP) uses specific commands to transfer mail. The SUBJECT: field identifies the subject of the emails. How to remove this vulnerability This activity can be examined for compliance with acceptable use policies, or for suspicion of unauthorized disclosure of sensitive information. References ISS X-Force Email subject http://xforce.iss.net/static/644.php Email to (Email_To) About this signature or vulnerability This signature records the receiver of an SMTP email message by looking for SMTP RCPT TO: messages. In combination with the other email signatures, this signature can construct a log of all email activity, including date, time, usernames, and the subject of the message. Default risk level Low 126 Avirt mail server allows remote users to create directories (Email_To_Dot_Dot) Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 Systems affected SMTP servers Type Protocol Signature Vulnerability description The Simple Mail Transfer Protocol (SMTP) uses specific commands to transfer mail. The RCPT TO: field identifies the receiver of an SMTP email message. A large number of To lines in a single SMTP message may indicate that this message is "spam" (electronic unsolicited literature disseminated to a large number of recipients). How to remove this vulnerability This activity can be examined for compliance with acceptable use policies, or for suspicion of unauthorized disclosure of sensitive information. References ISS X-Force Email to http://xforce.iss.net/static/645.php Avirt mail server allows remote users to create directories (Email_To_Dot_Dot) About this signature or vulnerability This signature detects email messages containing specially-crafted data in the RCPT TO: field, which may indicate an attempt by an attacker to create arbitrary directories on the mail server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.3 Systems affected Avirt Mail Server: 3.3a, Avirt Mail Server: 3.5 Type Unauthorized Access Attempt Vulnerability description Avirt Mail Server versions 3.3a and 3.5 could allow a remote attacker to create arbitrary directories anywhere on the mail server. A remote attacker could send a specially-crafted email to create a directory at any location on the mail server. How to remove this vulnerability No remedy available as of March 2001. References BugTraq Mailing List, Tue Nov 02 1999 08:12:41 Avirt Mail Server 3.3a or 3.5 remotely exploitable buffer overflow vulnerability http://www.securityfocus.com/archive/1/33318 127 SMTP verify (VRFY) command can be used to validate users (Email_Vrfy) ISS X-Force Avirt mail server allows remote users to create directories http://xforce.iss.net/static/3432.php SMTP TURN command reverses connections (Email_Turn) False positives RealSecure Network Sensor: E-mail content containing the "turn" string in the proper configuration can trigger this signature inappropriately. Since only particularly old versions of Sendmail are vulnerable to this attack, an E-Mail Turn event is likely to be a false positive. RealSecure Server Sensor: E-mail content containing the "turn" string in the proper configuration can trigger this signature inappropriately. Since only very, very old versions of Sendmail are vulnerable to this attack, an E-Mail Turn event is likely to be a false positive. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected SMTP servers Type Protocol Signature Vulnerability description The SMTP TURN command described in RFC 821 allows an SMTP session to be "turned around" so the server can then send any mail it has to the caller, avoiding the need for a separate TCP connection. However, since there is no way to truly verify the identity of the caller, this could be used by an attacker to pick up mail intended for other hosts. How to remove this vulnerability This command is often unimplemented in modern servers, but if it is found to exist in yours you should disable it. References Request for Comment document RFC 821 Simple Mail Transfer Protocol http://www.sendmail.org/rfc/0821.html ISS X-Force SMTP TURN command reverses connections http://xforce.iss.net/static/1227.php SMTP verify (VRFY) command can be used to validate users (Email_Vrfy) Additional Vulnerabilities Found 128 ■ smtp-sendmail-version5 ■ slmail-vrfyexpn-overflow SMTP verify (VRFY) command can be used to validate users (Email_Vrfy) False positives RealSecure Network Sensor: VRFY is a valid command, and false positive is possible for legitimate use of the VFRY command. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected SMTP servers, Solaris: 2.5.1, Solaris: 2.6, HP-UX: 10.20, Solaris: 7, Red Hat Linux: 6.0, Solaris: 8, AIX: 4.0, HP-UX: 11, Compaq: Tru64 UNIX Type Pre-attack Probe Vulnerability description The SMTP VRFY command is enabled. The VRFY (Verify) command allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. VRFY provides additional information about users on the system, such as if they exist and their full names. This information can be useful in futher attacks. How to remove this vulnerability If you are running Sendmail, add the line Opnovrfy to your Sendmail configuration file, usually located in /etc/sendmail.cf. For other mail servers, contact your vendor for information on how to disable the verify command. Upgrade to the latest version of Sendmail (8.11.3 or later), available from the Sendmail Consortium Web site. See References. Solaris: 2.5.1 Add the option 'Opnovrfy' to your sendmail.cf file. Solaris: 2.6 Add the option 'Opnovrfy' to your sendmail.cf file. HP-UX: 10.20 Add the option 'Opnovrfy' to your sendmail.cf file. Solaris: 7 Add the option 'Opnovrfy' to your sendmail.cf file. Red Hat Linux: 6.0 Add the option 'Opnovrfy' to your sendmail.cf file. Solaris: 8 Add the option 'Opnovrfy' to your sendmail.cf file. AIX: 4.0 Add the option 'Opnovrfy' to your sendmail.cf file. 129 SMTP VRFY buffer overflow can crash or obtain access (Email_Vrfy_Overflow) HP-UX: 11 Add the option 'Opnovrfy' to your sendmail.cf file. Compaq: Tru64 UNIX If you are running Sendmail, add the line Opnovrfy to your Sendmail configuration file, usually located in /etc/sendmail.cf. For other mail servers, contact your vendor for information on how to disable the verify command. Upgrade to the latest version of Sendmail (8.11.3 or later), available from the Sendmail Consortium Web site. References Sendmail Consortium Web site Sendmail FAQ http://www.sendmail.org/faq Sendmail Consortium Web site Latest software version http://www.sendmail.org Sendmail Consortium FTP site Latest software version ftp://ftp.cs.berkeley.edu/ucb/sendmail ISS X-Force SMTP verify (VRFY) command can be used to validate users http://xforce.iss.net/static/130.php CVE CAN-1999-0531 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0531 SMTP VRFY buffer overflow can crash or obtain access (Email_Vrfy_Overflow) Additional Vulnerabilities Found ■ smtp-sendmail-version5 ■ slmail-vrfyexpn-overflow False positives RealSecure Network Sensor: There are legitimate uses for VRFY during e-mail. You should use this attack signature carefully. You may want to record all VRFY requests and then analyze them off line for indications that your network is being probed. RealSecure Server Sensor: There are legitimate uses for VRFY during e-mail. You should use this attack signature carefully. You may want to record all VRFY requests and then analyze them off line for indications that your network is being probed. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected SMTP servers, SLMail: v2.6 and earlier, Mercury Mail Server, AppleShare IP Mail Server 130 SMTP VRFY buffer overflow can crash or obtain access (Email_Vrfy_Overflow) Type Unauthorized Access Attempt Vulnerability description Several freeware, shareware, and commercial SMTP servers contain buffer overflows. Different SMTP commands can cause the SMTP server to crash or to execute arbitrary byte-code that could lead to a system compromise. For example, the Seattle Lab SLMail SMTP server contains overflows in the VRFY and EXPN commands. AppleShare, Stalker, and Mercury SMTP servers contain overflows in the HELO command as well. Other lesser-known SMTP servers may also contain overflows. How to remove this vulnerability Determine if the SMTP server is vulnerable to the attack and take appropriate actions depending on the extent of the vulnerability. Test for this vulnerability by connecting to port 25 on the system and sending the appropriate command (HELO, VRFY, or EXPN) followed by at least 1024 X's. If the SMTP server returns an OK or an error message, then this system is not vulnerable. If the connection closes immediately, then the system is likely vulnerable. If the system is vulnerable, it may have already been compromised. If the attack was a denial of service attack, restart the SMTP server and watch for further attacks from the source address. If the system is not vulnerable, then it has not been compromised. However, the attack may be a sign of an attacker probing the network for other vulnerabilities. To remove this vulnerability, disable the VRFY service on the mail server. This will not affect your system's ability to receive or send email. References BugTraq Mailing List, Wed Mar 11 1998 17:44:56 SLMail 2.6 DoS http://www.securityfocus.com/archive/1/8748 BugTraq Mailing List, Wed Apr 08 1998 04:10:25 smtp overflows http://www.securityfocus.com/archive/1/8947 BugTraq Mailing List, Wed Apr 08 1998 13:34:09 Re: AppleShare IP Mail Server http://www.securityfocus.com/archive/1/8951 BugTraq Mailing List, Wed Apr 08 1998 18:11:17 AppleShare IP Mail Server http://www.securityfocus.com/archive/1/8952 Seattle Labs, Inc. Web site SLmail Overview http://www.seattlelabs.com/slmail/ ISS X-Force SMTP VRFY buffer overflow can crash or obtain access http://xforce.iss.net/static/887.php CVE CAN-1999-0531 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0531 131 Sendmail wizard (WIZ) backdoor allows anonymous remote root access (Email_WIZ) Sendmail wizard (WIZ) backdoor allows anonymous remote root access (Email_WIZ) False positives RealSecure Network Sensor: E-mail content containing the 'wiz' string could appear to be this attack. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Sendmail: Old Versions Type Unauthorized Access Attempt Vulnerability description Very old installations of the Sendmail mailing system contained a feature that allows a remote attacker connecting to the SMTP port to enter the "WIZ" command and be given an interactive shell with root privileges. How to remove this vulnerability If the WIZ command is enabled on Sendmail, it should be disabled by adding this line to the sendmail.cf configuration file (note that it must be typed in uppercase). OW* For the change to take effect, kill the Sendmail process, refreeze the sendmail.cf file, and restart the Sendmail process. References CERT Advisory CA-1993-14 Internet Security Scanner (ISS) http://www.cert.org/advisories/CA-1993-14.html Sendmail Consortium Web site Sendmail Homepage http://www.sendmail.org Dan Farmer and Wietse Venema Improving the Security of Your Site by Breaking Into it http://www.alw.nih.gov/Security/Docs/admin-guide-to-cracking.101.html ISS X-Force Sendmail wizard (WIZ) backdoor allows anonymous remote root access http://xforce.iss.net/static/131.php CVE CVE-1999-0145 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0145 132 Microsoft Exchange Server SMTP and NNTP denial of service (Email_Xchg_Auth) Microsoft Exchange Server SMTP and NNTP denial of service (Email_Xchg_Auth) Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5.2 Systems affected Microsoft Exchange: 5.0, Microsoft Exchange: 5.5 Type Denial of Service Vulnerability description Microsoft Exchange Server 5.0 and 5.5 are vulnerable to a denial of service attack caused by a buffer overflow in multiple commands (HELO, RCPT TO, and MAIL FROM). By exploiting this buffer overflow, a remote attacker can overflow the buffer and crash the server, and under some circumstances possibly execute arbitrary code on the system. This attack will stop email and other services that Exchange provides. However, the attack itself does not directly have any impact on the integrity of data stored by the Exchange Server. How to remove this vulnerability For Microsoft Exchange 5.5: Apply Exchange 5.5 Service Pack 1 or later, as listed in Microsoft Security Bulletin MS98007. See References. For Microsoft Exchange 5.0: Apply the appropriate hotfix for your system, as listed in Microsoft Security Bulletin MS98-007. See References. References Internet Security Systems Security Alert #04 Denial of Service attacks against Microsoft Exchange 5.0 to 5.5 http://xforce.iss.net/alerts/advise4.php CIAC Information Bulletin I-080 Microsoft Exchange Denial of Service Attacks http://ciac.llnl.gov/ciac/bulletins/i-080.shtml Microsoft Security Bulletin MS98-007 Potential SMTP and NNTP Denial-of-Service Vulnerabilities in Microsoft Exchange Server http://www.microsoft.com/technet/security/bulletin/ms98-007.asp Microsoft Knowledge Base Article Q188369 XADM: AUTHINFO Command Causes Information Store Problems http://support.microsoft.com/support/kb/articles/q188/3/69.asp Microsoft Knowledge Base Article Q188341 XFOR: AUTH and EHLO Commands Cause Internet Mail Service to Stop http://support.microsoft.com/support/kb/articles/q188/3/41.asp 133 RealSecure event collector error message (EventCollector_Error) Microsoft Web site Microsoft Servers - Exchange Server Home http://www.microsoft.com/exchange/ Microsoft Knowledge Base Article Q169174 XFOR: IMS Halts if RFC821 Address Over 1k in Size is Received http://support.microsoft.com/support/kb/articles/q169/1/74.asp ISS X-Force Microsoft Exchange Server SMTP and NNTP denial of service http://xforce.iss.net/static/1223.php CVE CAN-1999-1043 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1043 RealSecure event collector error message (EventCollector_Error) About this signature or vulnerability This signature detects a RealSecure event collector error message, which may indicate that the event collector has stopped functioning. Default risk level High Sensors that have this signature RealSecure Network Sensor: 6.0 Systems affected RealSecure Type Protocol Signature Vulnerability description The RealSecure event collector notifies the console when significant events occur that relate to the event collector's operation. There are three types of events that may be reported by the event collector: Error, Warning, and Information. Error events indicate that the event collector may have stopped functioning, and they should be investigated immediately. The specific error message will give further details about the problem and how it may have affected the event collector. If the error applies to only one subsystem of the event collector, it is possible that the event collector may continue to function; however, a RealSecure administrator should inspect the system to verify that it is functioning properly. How to remove this vulnerability Verify that the Event Collector is functioning properly. Correct any problems with the Event Collector as appropriate. More information about common RealSecure error messages is available in the SAFEsuite Support Knowledgebase. See References. 134 RealSecure Event Collector information message (EventCollector_Info) References Internet Security Systems, Inc. SAFEsuite Support Knowledgebase http://www.iss.net/customer_care/knowledgebase/ ISS X-Force RealSecure event collector error message http://xforce.iss.net/static/6469.php RealSecure Event Collector information message (EventCollector_Info) About this signature or vulnerability This signature detects a RealSecure event collector information message, which may provide useful information about normal event collector operations. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 6.0 Systems affected RealSecure Type Protocol Signature Vulnerability description The RealSecure event collector notifies the console when significant events occur that relate to the event collector's operation. There are three types of events that may be reported by the event collector: Error, Warning, and Information. Information events are usually status messages about normal system operation that are helpful for logging but do not require individual attention. The specific information message will give further details about the event. Information messages are often associated with services initializing and other successful operations. While these types of activities do not require any immediate intervention, they often contain useful information, and a RealSecure administrator may want to track these events for logging purposes. How to remove this vulnerability No action is needed to respond to Information event messages, because they are a part of normal event collector operation. More information about common RealSecure information messages is available in the SAFEsuite Support Knowledgebase. See References. References Internet Security Systems, Inc. SAFEsuite Support Knowledgebase http://www.iss.net/customer_care/knowledgebase/ ISS X-Force RealSecure Event Collector information message http://xforce.iss.net/static/6470.php 135 Event Horizon backdoor for Windows (EventHorizon) RealSecure event collector warning message (EventCollector_Warning) About this signature or vulnerability This signature detects RealSecure event collector warning messages, which may indicate that a minor problem has occurred with the event collector. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 6.0 Systems affected RealSecure Type Protocol Signature Vulnerability description The RealSecure event collector notifies the console when significant events occur that relate to the event collector's operation. There are three types of events that may be reported by the event collector: Error, Warning, and Information. Warning events are usually status messages about minor problems encountered by the event collector that do not need immediate attention. The specific warning message will give further details about the problem and how it may have affected the event collector. Warning messages are typically associated with recoverable problems that do not cause a loss of functionality or data; however, a RealSecure administrator may want to inspect the system to verify that it is functioning properly. How to remove this vulnerability Verify that the event collector is functioning properly. Correct any problems with the event collector as appropriate. More information about common RealSecure warning messages is available in the SAFEsuite Support Knowledgebase. See References. References Internet Security Systems, Inc. SAFEsuite Support Knowledgebase http://www.iss.net/customer_care/knowledgebase/ ISS X-Force RealSecure event collector warning message http://xforce.iss.net/static/6471.php Event Horizon backdoor for Windows (EventHorizon) About this signature or vulnerability This signature detects a TCP connection on port 4488 to an Event Horizon backdoor on your network. Default risk level High 136 EvilFTP backdoor FTP server for Windows (EvilFTP_Backdoor) Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Event Horizon backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Event Horizon backdoor, an attacker can do the following: ● execute arbitrary programs ● hijack passwords ● manipulate the current user's Windows session The Event Horizon backdoor listens on TCP port 4488 for a remote client (an attacker) to connect. Once connected, an attacker can begin sending commands to the host system. How to remove this vulnerability To remove the Event Horizon backdoor from your computer, restart the computer. Unlike many backdoors programs, the Event Horizon backdoor does not add itself to the computer's registry or system files and does not start automatically. References ISS X-Force Event Horizon backdoor for Windows http://xforce.iss.net/static/5389.php EvilFTP backdoor FTP server for Windows (EvilFTP_Backdoor) About this signature or vulnerability This signature detects a TCP connection on port 23456 to an EvilFTP backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 6.5 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The EvilFTP backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. When the program containing the trojan is run, EvilFTP installs an FTP server on port 12346 with the login "yo" and the password "connect." With the EvilFTP backdoor, an attacker can upload and download files from the system on which it was installed. 137 Windows event log file corrupted (evt_logcorrupt) How to remove this vulnerability To remove EvilFTP from your computer: For Windows 95 and Windows 98: In win.ini, delete the line run=c:\windows\system\msrun.exe. For Windows NT: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find and delete the HKCU\Software\Microsoft\Windows NT\Windows\run=msrun.exe registry key. 2. Remove Msrun.exe from the Windows system directory. References Internet Security Systems Security Alert #30 Windows Backdoor Update III http://xforce.iss.net/alerts/advise30.php PestPatrol Web site EvilFTP http://safersite.com/PestInfo/E/EvilFTP.asp ISS X-Force EvilFTP backdoor FTP server for Windows http://xforce.iss.net/static/2310.php Windows event log file corrupted (evt_logcorrupt) About this signature or vulnerability This signature detects a Windows event log message indicating that the Windows event log has been corrupted and will be cleared. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description The Eventlog service for Windows NT and Windows 2000 is part of the core Windows operating system and is maintained by the operating system itself. Corruption of any Windows event log should be an infrequent event and should be considered highly suspicious. If a Windows event log is cleared, all previously recorded event messages will be lost. This limits the ability to trace events prior to the clearing of the event log. 138 Windows event log full (evt_logfull) The corruption of a Windows event log could be caused by a Windows operating system error, or it could be an indication that an attacker has accessed the Windows system directory. How to remove this vulnerability Ensure that the Windows system directory is not corrupted and that the Windows operating system is functioning properly. Verify that security permissions for Windows event logs and the system directory are configured so that only intended security principals are granted access. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Windows event log file corrupted http://xforce.iss.net/static/4670.php Windows event log full (evt_logfull) About this signature or vulnerability This signature detects a Windows event log message indicating that the Windows event log is full. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description When a Windows event log reaches its maximum size, new events associated with that part of the operating system can no longer be recorded in the event log until the event log is cleared or the log size is increased. If a Windows event log becomes full, the operating system loses tracing capability for the operating system functions affected. This could compromise computer security, especially if the security log is full. Each Windows event log should be configured to contain at least two weeks of messages. This permits important events to be retained for tracing and debugging purposes. Possible causes of Windows event logs becoming full frequently may include the following: ● limited log file size ● operating system or application failure ● attacker activity directed at the Windows operating system 139 Windows event log full (evt_logfull) How to remove this vulnerability Ensure that the operating system and all applications are functioning properly. Investigate for evidence of tampering of the system. Increase the Windows event log size and adjust event log wrapping options if necessary. See below. To increase the event log size: For Windows NT: 1. Open the Windows NT Event Viewer. From the Windows NT Start menu, select Programs, Administrative Tools (Common), Event Viewer. 2. From the Log menu, select Log Settings. 3. Select the event log of interest. 4. In the Maximum Log Size field, increase the maximum size of the event log. For Windows 2000: 1. Open the Windows 2000 Event Viewer. From the Windows Start menu, select Settings —> Control Panel, double-click Administrative Tools, and then double-click Event Viewer. 2. In the Event Viewer Tree, select the log of interest. 3. From the Action menu, select Properties. 4. In the Maximum Log Size field, increase the maximum size of the event log. To modify event log wrapping options for the Windows event log: For Windows NT: 1. Open the Windows NT Event Viewer. From the Windows NT Start menu, select Programs, Administrative Tools (Common), Event Viewer. 2. From the Log menu, select Log Settings. 3. Select the event log of interest. 4. In the Event Log Wrapping group box, select "Overwrite events older than," and set the value to 14 days or greater. For Windows 2000: 1. Open the Windows 2000 Event Viewer. From the Windows Start menu, select Settings —> Control Panel, double-click Administrative Tools, and then double-click Event Viewer. 2. In the Event Viewer Tree, select the log of interest. 3. From the Action menu, select Properties. 4. In the Log Size group box, select "Overwrite events older than," and set the value to 14 days or greater. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp 140 Exchange administrative user connected (Exchange55_administrator_connect) ISS X-Force Windows event log full http://xforce.iss.net/static/4702.php Windows event log file cannot be opened (evt_openfail) About this signature or vulnerability This signature detects a Windows event log message indicating that a Windows event log file cannot be opened. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: XPU 1.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows 2000 Type Host Sensor Vulnerability description The Windows event log is critical to the security and operation of the Windows NT and Windows 2000 operating system. When the Windows Eventlog service is unable to open any particular event log, the corresponding part of the operating system loses its tracing capability. Possible causes of the Windows event log failing to open include the following: ● misconfiguration of log file permissions ● attacker activity directed at the Windows operating system How to remove this vulnerability Examine the permissions of the log file in question. Ensure that the Windows NT system directory is not corrupted and that the log file is not locked by another process. Verify that the security permissions of the Windows NT event logs and system directory are configured so that only intended security principals are granted access. References Microsoft TechNet, Windows NT Server Concepts and Planning Manual Chapter 9 - Monitoring Events http://www.microsoft.com/technet/winnt/Winntas/manuals/concept/xcp09.asp ISS X-Force Windows event log file cannot be opened http://xforce.iss.net/static/4671.php Exchange administrative user connected (Exchange55_administrator_connect) About this signature or vulnerability The Exchange55_administrator_connect signature detects when a user with administrator privileges connects to a Microsoft Exchange 5.5 server. 141 Exchange Administrator logged in (Exchange55_administrator_login_as_user) Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.0 Systems affected Windows NT Type Host Sensor Vulnerability description A user with administrative privileges has connected to Microsoft Exchange. All administrative activities should be monitored and retained in an audit history. How to remove this vulnerability Verify that all administrative activity is monitored and retained in an audit history. If there is no legitimate reason for this connection to occur, or if the connection occurs at unusual times, then this activity may be an indication of misuse. References ISS X-Force Exchange administrative user connected http://xforce.iss.net/static/3188.php Exchange Administrator logged in (Exchange55_administrator_login_as_user) About this signature or vulnerability The Exchange55_administrator_login_as_user signature detects when a user with administrator privileges logs on to a Microsoft Exchange 5.5 server. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.0 Systems affected Windows NT Type Host Sensor Vulnerability description A user with administrative privileges has logged into Microsoft Exchange. All administrative activities should be monitored and retained in an audit history. How to remove this vulnerability Verify that all administrative logins (both successful and unsuccessful logins) are monitored and retained in an audit history. If there is no legitimate reason for a login to occur, or if logins occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Exchange Administrator logged in http://xforce.iss.net/static/3186.php 142 Exchange POP3 server unauthenticated command (Exchange55_unauthenticated_pop3_command) Exchange POP3 server dropped connection (Exchange55_pop3_authentication_failures) About this signature or vulnerability The Exchange55_pop3_authentication_failures signature detects that a Microsoft Exchange 5.5 POP3 server has dropped its connection, due to repeated authentication failures. Default risk level Low Sensors that have this signature RealSecure Server Sensor: 6.0 Systems affected Windows NT Type Denial of Service Vulnerability description A Post Office Protocol 3 (POP3) server is a simple mail server commonly used on the Internet. Repeated authentication failures have caused the Microsoft Exchange POP3 Server to drop its connection. How to remove this vulnerability A connection dropped by the server may indicate that a user has repeatedly mistyped the password. Multiple instances of this event should be considered suspicious and could indicate a brute force attack. References ISS X-Force Exchange POP3 server dropped connection http://xforce.iss.net/static/3175.php Exchange POP3 server unauthenticated command (Exchange55_unauthenticated_pop3_command) About this signature or vulnerability The Exchange55_unauthenticated_pop3_command signature detects when a client has connected to the Microsoft Exchange 5.5 POP3 server and has issued commands before being authenticated. Default risk level Low Sensors that have this signature RealSecure Server Sensor: 6.0 Systems affected Windows NT Type Suspicious Activity 143 Exchange POP3 server invalid unauthenticated command (Exchange55_unauthenticated_pop3_command_invalid) Vulnerability description A Post Office Protocol 3 (POP3) server is a simple mail server commonly used on the Internet. A client has connected to the Microsoft Exchange POP3 server and has issued commands before being authenticated. Unauthenticated commands may indicate that an attacker is attempting to identify servers that allow anonymous login. It is also possible that improperly configured or unusual client software may trigger this event during a legitimate logon. How to remove this vulnerability Inspect the unauthenticated command that was executed for malicious characteristics. For example, an especially long command may be an attempt to exploit potential buffer overflows. If your security policies allow anonymous access to the server, then no authentication is required before executing commands. Allowing anonymous login is generally not good security practice. Under these conditions, this event would only be useful in monitoring activity, not detecting potential attacks. Consider disabling anonymous access for tighter security. References ISS X-Force Exchange POP3 server unauthenticated command http://xforce.iss.net/static/3179.php Exchange POP3 server invalid unauthenticated command (Exchange55_unauthenticated_pop3_command_invalid) About this signature or vulnerability The Exchange55_unauthenticated_pop3_command_invalid signature detects when Microsoft Exchange 5.5 POP3 server receives an unauthenticated and invalid POP command. Default risk level Low Sensors that have this signature RealSecure Server Sensor: 6.0 Systems affected Windows Type Suspicious Activity Vulnerability description A Post Office Protocol 3 (POP3) server is a simple mail server commonly used on the Internet. An unauthenticated and invalid POP command was issued to the Microsoft Exchange POP3 server. This activity suggests a manual or malicious connection, because most compatible mail client software packages issue properly formed commands. How to remove this vulnerability Inspect the unauthenticated command for malicious characteristics. For example, an especially long command or argument may be an attempt to exploit potential buffer overflows. If you have the ability to trace the command back to its originator, then it may be possible to determine the reason for this anomaly, or to block access to the source of the problem. 144 Exchange POP3 server invalid unauthenticated arguments (Exchange55_unauthenticated_pop3_command_invalidargs) If your security policies allow anonymous access to the server, then no authentication is required before executing commands. Allowing anonymous login is generally considered to be poor security practice. Consider disabling anonymous access for tighter security. References ISS X-Force Exchange POP3 server invalid unauthenticated command http://xforce.iss.net/static/3182.php Exchange POP3 server invalid unauthenticated arguments (Exchange55_unauthenticated_pop3_command_invalidargs) About this signature or vulnerability The Exchange55_unauthenticated_pop3_command_invalidargs signature detects when Microsoft Exchange 5.5 POP3 server receives an unauthenticated POP command with invalid arguments. Default risk level Low Sensors that have this signature RealSecure Server Sensor: 6.0 Systems affected Windows NT Type Suspicious Activity Vulnerability description A Post Office Protocol 3 (POP3) server is a simple mail server commonly used on the Internet. An unauthenticated POP command containing invalid arguments was issued to the Microsoft Exchange POP3 server. This activity suggests a manual or malicious connection, because most compatible mail client software packages issue properly formed commands. How to remove this vulnerability Inspect the unauthenticated command for malicious characteristics. For example, an especially long command or argument may be an attempt to exploit potential buffer overflows. If possible, trace the command back to its originator to determine the reason for this anomaly, or to block access to the source of the problem. If your security policies allow anonymous access to the server, then no authentication is required before executing commands. Allowing anonymous login is generally considered to be a poor security practice. Consider disabling anonymous access for tighter security. References ISS X-Force Exchange POP3 server invalid unauthenticated arguments http://xforce.iss.net/static/3181.php 145 Exchange View Administrative user logged in (Exchange55_view_administrator_login) Exchange POP3 server incorrect number of unauthenticated arguments (Exchange55_unauthenticated_pop3_command_wrongargs) About this signature or vulnerability The Exchange55_unauthenticated_pop3_command_wrongargs signature detects when Microsoft Exchange 5.5 POP3 server receives an unauthenticated POP command with an incorrect number of arguments. Default risk level Low Sensors that have this signature RealSecure Server Sensor: 6.0 Systems affected Windows NT Type Suspicious Activity Vulnerability description A Post Office Protocol 3 (POP3) server is a simple mail server commonly used on the Internet. An unauthenticated POP command containing the incorrect number of arguments was issued to the Microsoft Exchange POP3 server. This activity suggests a manual or malicious connection, because most compatible mail client software packages issue properly formed commands. How to remove this vulnerability Inspect the unauthenticated command for malicious characteristics. For example, an especially long command or argument may be an attempt to exploit potential buffer overflows. If possible, trace the command back to its originator to determine the reason for this anomaly, or to block access to the source of the problem. If your security policies allow anonymous access to the server, then no authentication is required before executing commands. Allowing anonymous login is generally considered to be a poor security practice. Consider disabling anonymous access for tighter security. References ISS X-Force Exchange POP3 server incorrect number of unauthenticated arguments http://xforce.iss.net/static/3180.php Exchange View Administrative user logged in (Exchange55_view_administrator_login) About this signature or vulnerability The Exchange55_view_administrator_login signature detects when a user with view administrative privileges logs on to a Microsoft Exchange 5.5 server. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.0 146 Exchange administrative user connected (Exchange_administrator_connect) Systems affected Windows NT Type Host Sensor Vulnerability description A user with view administrative privileges has logged into Microsoft Exchange. All administrative activities should be monitored and retained in an audit history. How to remove this vulnerability Verify that all administrative logins (both successful and unsuccessful logins) are monitored and retained in an audit history. If there is no legitimate reason for a login to occur, or if logins occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Exchange View Administrative user logged in http://xforce.iss.net/static/3187.php Exchange administrative user connected (Exchange_administrator_connect) About this signature or vulnerability The Exchange_administrator_connect signature detects when a user with administrator privileges connects to a Microsoft Exchange server. This signature applies to versions of Microsoft Exchange prior to 5.5. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A user with administrative privileges has connected to Microsoft Exchange. All administrative activities should be monitored and retained in an audit history. How to remove this vulnerability Verify that all administrative activity is monitored and retained in an audit history. If there is no legitimate reason for this connection to occur, or if the connection occurs at unusual times, then this activity may be an indication of misuse. References ISS X-Force Exchange administrative user connected http://xforce.iss.net/static/3188.php 147 Exchange anonymous logon (Exchange_anonymous_logon) Exchange Administrator logged in (Exchange_administrator_login_as_user) About this signature or vulnerability The Exchange_administrator_login_as_user signature detects when a user with administrator privileges logs on to a Microsoft Exchange server. This signature applies to versions of Microsoft Exchange prior to 5.5. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A user with administrative privileges has logged into Microsoft Exchange. All administrative activities should be monitored and retained in an audit history. How to remove this vulnerability Verify that all administrative logins (both successful and unsuccessful logins) are monitored and retained in an audit history. If there is no legitimate reason for a login to occur, or if logins occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Exchange Administrator logged in http://xforce.iss.net/static/3186.php Exchange anonymous logon (Exchange_anonymous_logon) About this signature or vulnerability This signature detects when a client has anonymously logged on to the Microsoft Exchange server. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Unauthorized Access Attempt Vulnerability description Microsoft Exchange can be configured to allow logins without authentication (anonymous login). Allowing anonymous login is generally considered a poor security practice. 148 Exchange mailbox logon failed (Exchange_logon_failure) How to remove this vulnerability Configure the Microsoft Exchange server to prevent anonymous logins. References ISS X-Force Exchange anonymous logon http://xforce.iss.net/static/3176.php Exchange IMAP server dropped connection (Exchange_imap_authentication_failures) About this signature or vulnerability This signature detects that a Microsoft Exchange IMAP server has dropped its connection, due to repeated authentication failures. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Denial of Service Vulnerability description Repeated authentication failures have caused the Microsoft Exchange IMAP Server to drop its connection. The Internet Messaging Access Protocol (IMAP) server is a standard mail server that holds incoming email until users log on and download it. How to remove this vulnerability A connection dropped by the server may indicate that a user has repeatedly mistyped the password. Multiple instances of this event should be considered suspicious and could indicate a brute force attack. References ISS X-Force Exchange IMAP server dropped connection http://xforce.iss.net/static/3173.php Exchange mailbox logon failed (Exchange_logon_failure) About this signature or vulnerability This signature detects failed attempts to log on to a Microsoft Exchange mailbox. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT 149 Exchange mail sent as another user (Exchange_mail_sent_as) Type Host Sensor Vulnerability description A failed attempt to log on to a Microsoft Exchange mailbox has occurred. How to remove this vulnerability Frequent logon failures may indicate a misconfigured mail client or user error. Attempts to log on using an inappropriate account could indicate attempts by an attacker to brute force the Exchange server, access the mailbox user's account, or change the user's settings. References ISS X-Force Exchange mailbox logon failed http://xforce.iss.net/static/3190.php Exchange mail sent as another user (Exchange_mail_sent_as) About this signature or vulnerability This signature detects when a mail user sends an email message as another user. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description Some types of mail activity require or encourage messages to be sent from users other than the mailbox owner. Anonymous mailers, departmental or company-wide broadcast mail, and special purpose announcements use this type of remailing feature. How to remove this vulnerability Determine if the mailbox owner has authorized other users to send messages using the owner's user name: References ● If the mailbox owner has authorized others to send messages using the owner's user name, and your organization considers this activity a poor security practice, then instruct the user on the proper policy. ● If the mailbox owner has not authorized others to send mail using the owner's user name, then another user may be forging or spoofing the user name in the message. Refer to the mail logs and mail headers to determine the source of the message. ISS X-Force Exchange mail sent as another user http://xforce.iss.net/static/3192.php 150 Exchange NNTP server dropped connection (Exchange_nntp_authentication_failures) Exchange mail sent on behalf of another user (Exchange_mail_sent_on_behalf) About this signature or vulnerability This signature detects when a mail user has sent an email message on behalf of another user. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description It is possible for a mail user to send an email message on behalf of another user. These types of messages may be sent without consulting the primary mail user, and the message or its contents may have been sent without the primary user's knowledge or approval. How to remove this vulnerability Some types of mail activity require or encourage the use of 'on behalf of' messages. Mailing lists, mail redirectors, and moderated lists take advantage of this feature. Determine if the primary mailbox user is aware that other users are sending messages on their behalf: References ● If the primary user has authorized others to send messages on his or her behalf, and your organization considers this activity a poor security practice, then instruct the user on the proper policy. ● If the primary user has not authorized others to send mail on their behalf, then another user may have unauthorized access to the account. ISS X-Force Exchange mail sent on behalf of another user http://xforce.iss.net/static/3191.php Exchange NNTP server dropped connection (Exchange_nntp_authentication_failures) About this signature or vulnerability This signature detects that a Microsoft Exchange NNTP server has dropped its connection, due to repeated authentication failures. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 151 Exchange POP3 server dropped connection (Exchange_pop3_authentication_failures) Systems affected Windows NT Type Denial of Service Vulnerability description Repeated authentication failures have caused the Microsoft Exchange NNTP Server to drop its connection. The Network News Transfer Protocol (NNTP) server allows users to access and read Usenet newsgroups on their newsreaders. How to remove this vulnerability A connection dropped by the server may indicate that a user has repeatedly mistyped the password. Multiple instances of this event should be considered suspicious and could indicate a brute force attack. References ISS X-Force Exchange NNTP server dropped connection http://xforce.iss.net/static/3174.php Exchange POP3 server dropped connection (Exchange_pop3_authentication_failures) About this signature or vulnerability The Exchange_pop3_authentication_failures signature detects that a Microsoft Exchange POP3 server has dropped its connection, due to repeated authentication failures. This signature applies to versions of Microsoft Exchange prior to 5.5. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Denial of Service Vulnerability description A Post Office Protocol 3 (POP3) server is a simple mail server commonly used on the Internet. Repeated authentication failures have caused the Microsoft Exchange POP3 Server to drop its connection. How to remove this vulnerability A connection dropped by the server may indicate that a user has repeatedly mistyped the password. Multiple instances of this event should be considered suspicious and could indicate a brute force attack. References ISS X-Force Exchange POP3 server dropped connection http://xforce.iss.net/static/3175.php 152 Exchange security attributes changed (Exchange_security_attribute_change) Exchange personal storage file password saved (Exchange_PST_passwords_saved) About this signature or vulnerability This signature detects when Microsoft Exchange has saved the passwords for certain Personal Storage (PST) files in the specified file. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description Microsoft Exchange Personal storage (PST) files maintain the user messages for an individual user. Microsoft Exchange may automatically create these files during the use of the Migration Wizard. When the Migration Wizard creates PST files, Microsoft Exchange may automatically assign random passwords to the files. Exchange stores these passwords in the file described in this event. Due to the sensitive password information contained in this file, an administrator should ensure that the file is sufficiently protected. How to remove this vulnerability Locate any PST files and set file permissions to allow full control only to the user and other authorized accounts. Remove any permissions that allow unauthorized users to read or otherwise access the file. References ISS X-Force Exchange personal storage file password saved http://xforce.iss.net/static/3193.php Exchange security attributes changed (Exchange_security_attribute_change) About this signature or vulnerability This signature detects when security attributes of objects used through Microsoft Exchange have been changed. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Suspicious Activity 153 Exchange service account password change (Exchange_service_password_change) Vulnerability description Security attributes of objects used through Microsoft Exchange are being changed. Security attributes control how objects, such as files, can be used within Microsoft Exchange. How to remove this vulnerability During normal administrative activities, security attributes may sometimes change. However, if there is no legitimate reason for a change to occur, or if attribute changes occur at unusual times, then this activity may be an indication of misuse. Changes in security attributes should be monitored and retained in an audit history. References ISS X-Force Exchange security attributes changed http://xforce.iss.net/static/3185.php Exchange service account password change (Exchange_service_password_change) About this signature or vulnerability This signature detects when the password for a Microsoft Exchange service account has been changed. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Suspicious Activity Vulnerability description The service account used by Microsoft Exchange is a Windows NT account that has administrator privileges. The password for this service account has been changed. How to remove this vulnerability Regularly changing passwords on sensitive or administrative accounts is good security practice. Verify that an authorized administrator changed the password. As an administrative activity, all instances of password changes to the Microsoft Exchange service account should be monitored or retained in an audit history. If the password was not changed by an authorized administrator, it may indicate that an intruder or other unauthorized person has administrative access to this system. If you determine that the password change was unauthorized, then this computer and perhaps other computers on the network may be compromised. References ISS X-Force Exchange service account password change http://xforce.iss.net/static/3183.php 154 Exchange unauthenticated logon attempt (Exchange_unauthenticated_logon_attempt) Exchange IMAP server unauthenticated command (Exchange_unauthenticated_imap_command) About this signature or vulnerability This signature detects when a client has connected to the Microsoft Exchange IMAP server and has issued commands before being authenticated. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Suspicious Activity Vulnerability description The Internet Messaging Access Protocol (IMAP) server is a standard mail server that holds incoming email until users log on and download it. A client has connected to the Microsoft Exchange IMAP server and has issued commands before being authenticated. Unauthenticated commands may indicate that an attacker is attempting to identify servers that allow anonymous login. It is also possible that improperly configured or unusual client software may trigger this event during a legitimate logon. How to remove this vulnerability Inspect the unauthenticated command that was executed for malicious characteristics. For example, an especially long command may be an attempt to exploit potential buffer overflows. If your security policies allow anonymous access to the server, then no authentication is required before executing commands. Allowing anonymous login is generally considered to be a poor security practice. Under these conditions, this event would only be useful in monitoring activity, not detecting potential attacks. Consider disabling anonymous access for stronger security. References ISS X-Force Exchange IMAP server unauthenticated command http://xforce.iss.net/static/3177.php Exchange unauthenticated logon attempt (Exchange_unauthenticated_logon_attempt) About this signature or vulnerability This signature detects when a Microsoft Exchange server has received a logon attempt without prior authentication. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Medium 155 Exchange NNTP server unauthenticated command (Exchange_unauthenticated_nntp_command) Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Suspicious Activity Vulnerability description Microsoft Exchange received a logon attempt without prior authentication. Exchange versions prior to Exchange 2000 allow unauthenticated users to log on because the Exchange security model can operate independently from the Windows security model. How to remove this vulnerability For all users, require Windows authentication before allowing users to attempt to log into an Exchange server. References ISS X-Force Exchange unauthenticated logon attempt http://xforce.iss.net/static/3184.php Exchange NNTP server unauthenticated command (Exchange_unauthenticated_nntp_command) About this signature or vulnerability This signature detects when a client has connected to the Microsoft Exchange NNTP server and has issued commands before being authenticated. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Suspicious Activity Vulnerability description The Network News Transfer Protocol (NNTP) server allows users to access and read Usenet newsgroups on their news client software. A client has connected to the Microsoft Exchange NNTP server and has issued commands before being authenticated. Unauthenticated commands may indicate that an attacker is attempting to identify servers that allow anonymous login. It is also possible that improperly configured or unusual client software may trigger this event during a legitimate logon. How to remove this vulnerability Inspect the unauthenticated command that was executed for malicious characteristics. For example, an especially long command may be an attempt to exploit potential buffer overflows. If your security policies allow anonymous access to the server, then no authentication is required before executing commands. Allowing anonymous login is generally considered 156 Exchange POP3 server unauthenticated command (Exchange_unauthenticated_pop3_command) to be a poor security practice. Under these conditions, this event would only be useful in monitoring activity, not detecting potential attacks. Consider disabling anonymous access for tighter security. References ISS X-Force Exchange NNTP server unauthenticated command http://xforce.iss.net/static/3178.php Exchange POP3 server unauthenticated command (Exchange_unauthenticated_pop3_command) About this signature or vulnerability The Exchange_unauthenticated_pop3_command signature detects when a client has connected to the Microsoft Exchange POP3 server and has issued commands before being authenticated. This signature applies to versions of Microsoft Exchange prior to 5.5. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Suspicious Activity Vulnerability description A Post Office Protocol 3 (POP3) server is a simple mail server commonly used on the Internet. A client has connected to the Microsoft Exchange POP3 server and has issued commands before being authenticated. Unauthenticated commands may indicate that an attacker is attempting to identify servers that allow anonymous login. It is also possible that improperly configured or unusual client software may trigger this event during a legitimate logon. How to remove this vulnerability Inspect the unauthenticated command that was executed for malicious characteristics. For example, an especially long command may be an attempt to exploit potential buffer overflows. If your security policies allow anonymous access to the server, then no authentication is required before executing commands. Allowing anonymous login is generally not good security practice. Under these conditions, this event would only be useful in monitoring activity, not detecting potential attacks. Consider disabling anonymous access for tighter security. References ISS X-Force Exchange POP3 server unauthenticated command http://xforce.iss.net/static/3179.php 157 Exchange POP3 server invalid unauthenticated arguments (Exchange_unauthenticated_pop3_command_invalidargs) Exchange POP3 server invalid unauthenticated command (Exchange_unauthenticated_pop3_command_invalid) About this signature or vulnerability The Exchange_unauthenticated_pop3_command_invalid signature detects when Microsoft Exchange POP3 server receives an unauthenticated and invalid POP command. This signature applies to versions of Microsoft Exchange prior to 5.5. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows Type Suspicious Activity Vulnerability description A Post Office Protocol 3 (POP3) server is a simple mail server commonly used on the Internet. An unauthenticated and invalid POP command was issued to the Microsoft Exchange POP3 server. This activity suggests a manual or malicious connection, because most compatible mail client software packages issue properly formed commands. How to remove this vulnerability Inspect the unauthenticated command for malicious characteristics. For example, an especially long command or argument may be an attempt to exploit potential buffer overflows. If you have the ability to trace the command back to its originator, then it may be possible to determine the reason for this anomaly, or to block access to the source of the problem. If your security policies allow anonymous access to the server, then no authentication is required before executing commands. Allowing anonymous login is generally considered to be poor security practice. Consider disabling anonymous access for tighter security. References ISS X-Force Exchange POP3 server invalid unauthenticated command http://xforce.iss.net/static/3182.php Exchange POP3 server invalid unauthenticated arguments (Exchange_unauthenticated_pop3_command_invalidargs) About this signature or vulnerability The Exchange_unauthenticated_pop3_command_invalidargs signature detects when Microsoft Exchange POP3 server receives an unauthenticated POP command with invalid arguments. This signature applies to versions of Microsoft Exchange prior to 5.5. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 158 Exchange POP3 server incorrect number of unauthenticated arguments Systems affected Windows NT Type Suspicious Activity Vulnerability description A Post Office Protocol 3 (POP3) server is a simple mail server commonly used on the Internet. An unauthenticated POP command containing invalid arguments was issued to the Microsoft Exchange POP3 server. This activity suggests a manual or malicious connection, because most compatible mail client software packages issue properly formed commands. How to remove this vulnerability Inspect the unauthenticated command for malicious characteristics. For example, an especially long command or argument may be an attempt to exploit potential buffer overflows. If possible, trace the command back to its originator to determine the reason for this anomaly, or to block access to the source of the problem. If your security policies allow anonymous access to the server, then no authentication is required before executing commands. Allowing anonymous login is generally considered to be a poor security practice. Consider disabling anonymous access for tighter security. References ISS X-Force Exchange POP3 server invalid unauthenticated arguments http://xforce.iss.net/static/3181.php Exchange POP3 server incorrect number of unauthenticated arguments (Exchange_unauthenticated_pop3_command_wrongargs) About this signature or vulnerability The Exchange_unauthenticated_pop3_command_wrongargs signature detects when Microsoft Exchange POP3 server receives an unauthenticated POP command with an incorrect number of arguments. This signature applies to versions of Microsoft Exchange prior to 5.5. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Suspicious Activity Vulnerability description A Post Office Protocol 3 (POP3) server is a simple mail server commonly used on the Internet. An unauthenticated POP command containing the incorrect number of arguments was issued to the Microsoft Exchange POP3 server. This activity suggests a manual or malicious connection, because most compatible mail client software packages issue properly formed commands. 159 Exchange mailbox accessed by other user (Exchange_user_login_into_other_users_mailbox) How to remove this vulnerability Inspect the unauthenticated command for malicious characteristics. For example, an especially long command or argument may be an attempt to exploit potential buffer overflows. If possible, trace the command back to its originator to determine the reason for this anomaly, or to block access to the source of the problem. If your security policies allow anonymous access to the server, then no authentication is required before executing commands. Allowing anonymous login is generally considered to be a poor security practice. Consider disabling anonymous access for tighter security. References ISS X-Force Exchange POP3 server incorrect number of unauthenticated arguments http://xforce.iss.net/static/3180.php Exchange mailbox accessed by other user (Exchange_user_login_into_other_users_mailbox) About this signature or vulnerability This signature detects when a user other than the primary mailbox user has accessed a mailbox. This signature applies to Microsoft Exchange version 5.5 and earlier. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description Microsoft Exchange monitors the identity of the primary Windows NT user for each Exchange mailbox. A user other than the primary mailbox user has accessed a mailbox. It is possible to share an account, but doing so may indicate poor security practice. It may also indicate that a Windows NT user has gained illegitimate access to the account. How to remove this vulnerability In some environments, such as collaborative efforts or departmental mail accounts, mailbox sharing is an accepted practice. Determine if the primary mailbox user is sharing the account: References ● If the primary user is sharing the account and your organization considers sharing accounts as poor security practice, then instruct the user on the proper policy. ● If the primary user is not sharing their account, then another user may have unauthorized access to the account. ISS X-Force Exchange mailbox accessed by other user http://xforce.iss.net/static/3189.php 160 Exchange View Administrative user logged in (Exchange_view_administrator_login) Exchange View Administrative user logged in (Exchange_view_administrator_login) About this signature or vulnerability The Exchange_view_administrator_login signature detects when a user with view administrative privileges logs on to a Microsoft Exchange server. This signature applies to versions of Microsoft Exchange prior to 5.5. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A user with view administrative privileges has logged into Microsoft Exchange. All administrative activities should be monitored and retained in an audit history. How to remove this vulnerability Verify that all administrative logins (both successful and unsuccessful logins) are monitored and retained in an audit history. If there is no legitimate reason for a login to occur, or if logins occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Exchange View Administrative user logged in http://xforce.iss.net/static/3187.php 161 Failed login attempt to a disabled user account (Failed_login-account_disabled) System file or executable modification attempt failed (Failed_change_of_important_files) About this signature or vulnerability This signature detects a security event log message indicating that an attempt to modify a system file or executable has failed. Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Unix, Windows NT Type Host Sensor Vulnerability description In Windows NT/2000 and Solaris systems, a message is written into the security log when an attempt to modify an important file fails. If an important executable is accessed for modification, it should only be by users with proper authority and reason to modify it. A failed attempt to modify key programs may indicate the actions of an attacker. How to remove this vulnerability Investigate these actions immediately. An attacker may be attempting to compromise an important executable by replacing it with a modified file. References ISS X-Force System file or executable modification attempt failed http://xforce.iss.net/static/1604.php Failed login attempt to a disabled user account (Failed_loginaccount_disabled) About this signature or vulnerability This signature detects a Windows security log message indicating that a login attempt to a disabled user account has failed. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor 162 Failed login attempt to an expired user account (Failed_login-account_expired) Vulnerability description Any time a user attempts to log in to the system and fails to do so, an event message is written into the Windows NT security log. When a user attempts to log in to a disabled account, this particular event is triggered. A good account management practice is to selectively disable accounts that are not being used (for example, disabling a user's account during a time when the user will be away from the system for an extended period of time). How to remove this vulnerability Attempts to access a disabled account can be the sign of a would-be attacker. You can disable and re-enable a user's account in the Windows NT User Manager utility. References ISS X-Force Failed login attempt to a disabled user account http://xforce.iss.net/static/1511.php Failed login attempt to an expired user account (Failed_loginaccount_expired) About this signature or vulnerability This signature detects a Windows security log message indicating that a login attempt to an expired user account has failed. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description In Windows NT, the system administrator can specify that a user account should expire on a specific date. The expiration of an account is independent of normal password expiration. Any time a user attempts to log in to the system and fails to do so, an event message is written into the Windows NT security log. How to remove this vulnerability To discourage a would-be intruder, implement a policy that watches for failed logins directly. Set the account policy in the Windows NT User Manager utility to expire passwords once every 60 days. Normally it is preferred to delete or disable user accounts that are no longer valid. A user attempting to access an expired account may be confused about the termination of access, or the user may be attempting to access the network inappropriately. In either case, the user should be notified that the account is no longer valid. 163 Failed login attempt to a locked user account (Failed_login-account_locked_out) References ISS X-Force Failed login attempt to an expired user account http://xforce.iss.net/static/1504.php Failed login attempt to a locked user account (Failed_loginaccount_locked_out) About this signature or vulnerability This signature detects a Windows security log message indicating that a user has attempted to log in using a locked user account. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A user has attempted to log in using a locked user account. Any time a user attempts to log in using a locked account, an audit message is written to the Windows NT security event log. When a user repeatedly attempts and fails to log in, the user account may be locked out. A user can also be locked out by a system administrator. Subsequent attempts by the user to log in to the account will fail. Windows NT will recognize these failed attempts as login attempts from a locked account. If a user continues to attempt to log in after an account has been locked out, then the event is a good indication that there is an intrusion attempt occurring, or that the user is misusing the login process. A brute force login attempt by an unsophisticated attacker may involve repeated attempts to guess a user's password. How to remove this vulnerability References To discourage misuse of Windows NT user accounts: ● Implement a policy that watches for failed logins directly. ● Set the account policy in the Windows NT User Manager utility to lock out accounts with more than 5 failed logon attempts. ● Contact any user who persists in trying to log in to a locked account. Inform the user of proper login procedure, and require the user to choose a new password. ISS X-Force Failed login attempt to a locked user account http://xforce.iss.net/static/1502.php 164 Failed login attempt with invalid username or password (Failed_login-bad_username_or_password) Windows NT user account locked out (Failed_loginaccount_locked_out_New) About this signature or vulnerability This signature detects that a Windows NT user account has been locked out. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 5.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT: 4.0 SP4, Windows 2000 Type Host Sensor Vulnerability description A Windows NT user account has been locked out. Any time a user account is locked out, an audit message is written to the Windows NT security event log in Windows NT Service Pack 4 and later. When a user repeatedly attempts and fails to log in, the user account may be locked out. A user can also be locked out by a system administrator. Subsequent attempts by the user to log in to the account will fail. Windows NT will recognize these failed attempts as login attempts from a locked account. If a user continues to attempt to log in after an account has been locked out, then the event is a good indication that there is an intrusion attempt occurring, or that the user is misusing the login process. A brute force login attempt by an unsophisticated attacker may involve repeated attempts to guess a user's password. How to remove this vulnerability References To discourage misuse of Windows NT user accounts: ● Implement a policy that watches for failed logins directly. ● Set the account policy in the Windows NT User Manager utility to lock out accounts with more than 5 failed logon attempts. ● Contact any user who persists in trying to log in to a locked account. Inform the user of proper login procedure, and require the user to choose a new password. ISS X-Force Windows NT user account locked out http://xforce.iss.net/static/4517.php Failed login attempt with invalid username or password (Failed_login-bad_username_or_password) About this signature or vulnerability This signature detects a security log message indicating that a login attempt has failed due to an invalid username or password. 165 Failed login attempt when net logon is not active (Failed_login-net_logon_not_active) Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Unix, Windows NT Type Host Sensor Vulnerability description Any time a user attempts to log in to the system and fails to do so, an event message is written into the security log. The most typical cause of these failures is a typing error when entering the username or password. A brute force login attempt by an unsophisticated attacker may involve repeated attempts to guess a user's password. These attempts may become obvious when an administrator notices a significant number of "bad password" event messages, particularly if they originate from a single user account. How to remove this vulnerability Windows NT/2000: To discourage a would-be intruder, implement a policy that watches for failed logins directly. Set the account policy in the User Manager utility to disable accounts with more than five failed logon attempts. This will disable accounts an intruder may be trying to gain access to. Solaris: To discourage a would-be intruder, implement a policy that imposes appropriate authentication checking when logging on to the host. For more information, see the man pages for pam.conf(4) and pam_unix(5). References ISS X-Force Failed login attempt with invalid username or password http://xforce.iss.net/static/1500.php Failed login attempt when net logon is not active (Failed_loginnet_logon_not_active) About this signature or vulnerability This signature detects a Windows security log message indicating that a user has attempted a net logon while the Net Logon service is not active. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor 166 Login attempt by user not authorized for console login (Failed_login-not_authorized_for_console_login) Vulnerability description The Net Logon service operates by pass-through authentication of account logons and may be used when the system is part of a domain. This requires the Net Logon service to be running. This event message is generated when a user attempts a net logon while the Net Logon service is not active. Very commonly, an installation may choose not to use the Net Logon service. A potential attacker may not know this and attempt remote logon while probing for a point of entry. How to remove this vulnerability If you have chosen to not use the Net Logon service, this event can be a good indicator of suspect access attempts. If this is the case, investigate the account from which these attempts originate. If you do use the Net Logon service, then this event message is an indication that something has caused the Net Logon service to fail, and legitimate users are being denied access. References ISS X-Force Failed login attempt when net logon is not active http://xforce.iss.net/static/1514.php Login attempt by user not authorized for console login (Failed_login-not_authorized_for_console_login) About this signature or vulnerability This signature detects a Windows security log message indicating that a user without local login privileges has attempted and failed to log on to the system. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description Any time a user attempts to log in to the system and fails to do so, an event message is written into the Windows NT security log. The right to log in to a system locally (at its console) is a special user right granted by the administrator. This event indicates a user has attempted to log in to a system locally and has not been granted this right. Typically the right to log in to a system's console is restricted to the primary user of that system or the administrator of that system. This is especially true for a system acting as a network server. Unauthorized attempts to log in at a system's console are particularly suspicious. How to remove this vulnerability The right to log on to a system locally is a specially-granted user right. It is prudent to only grant this right to users who have a specific, valid need to log on to the system. Grant individuals the right to log on to their workstations, but grant the logon rights to servers only to administrators and users with a specific, valid need to do so. These rights are granted through the Windows NT User Manager Utility. 167 Failed login attempt by user without the right to access the computer from the network (Failed_login- References ISS X-Force Login attempt by user not authorized for console login http://xforce.iss.net/static/1512.php Failed login attempt by user without the right to access the computer from the network (Failed_loginnot_authorized_for_this_type_of_login) About this signature or vulnerability This signature detects a Windows security log message indicating that a user without remote login privileges has attempted and failed to log on to the system. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description Any time a user attempts to log in to the system and fails to do so, an event message is written into the Windows NT security log. The right to log in to a system from the network is a special user right granted by the administrator. This event indicates a user who has not been granted this right has attempted to log in to a system remotely. Typically the right to log in to a system from the network is assigned to the Everyone group. This is especially true for a system acting as a network server. If network access to a system has been restricted, unauthorized attempts to log in to the system from the network may be suspicious. How to remove this vulnerability The right to log on to a system remotely is normally granted to the Everyone group. If there is a need to restrict access to a system from the network, this right can be restricted to privileged individuals only. These rights are granted through the Windows NT User Manager Utility. References Microsoft Knowledge Base Article Q159930 Event ID 534 In The Security Log http://support.microsoft.com/support/kb/articles/Q159/9/30.asp ISS X-Force Failed login attempt by user without the right to access the computer from the network http://xforce.iss.net/static/1513.php 168 Failed login attempt during restricted access hours (Failed_login-time_restriction_violation) Failed login with an expired password (Failed_loginpassword_expired) About this signature or vulnerability This signature detects a Windows security log message indicating that a logon has failed due to use of an expired password. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description Any time a user attempts to log in to the system and fails to do so, an event message is written into the Windows NT security log. An expired password will require the user to enter a new password in order to continue the login process. Choosing to have user passwords expire encourages users to change their passwords frequently. In the event that an attacker is able to access a legitimate user account, frequent password changes can limit the number of days an attacker is able to use the account. How to remove this vulnerability To discourage a would-be intruder, implement a policy that watches for failed logins directly. Set the account policy in the Windows NT User Manager utility to expire passwords once every 60 days. References ISS X-Force Failed login with an expired password http://xforce.iss.net/static/1506.php Failed login attempt during restricted access hours (Failed_login-time_restriction_violation) About this signature or vulnerability This signature detects a Windows security log message indicating that a user has attempted and failed to log on to the system during restricted access hours. Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT 169 Login attempt failed for an unknown reason (Failed_login-unknown_error) Type Host Sensor Vulnerability description Any time a user attempts to log on to the system and fails to do so, an event message is written into the Windows NT security log. A time restriction violation occurs when a user tries to log on before or after the hours that that user is allowed to access the system. A user (or an attacker assuming the identity of a legitimate user) may attempt access at off-hours. Failed attempts to log in during off-hours are suspicious. How to remove this vulnerability To discourage a would-be intruder, implement a policy that restricts the access times of user accounts to only those hours that the user requires. It is reasonable to grant 24x7 hour access to users who actually require it. However, broad access times should be granted sparingly. You can set the hours of access from the Account Properties window in the Windows NT User Manager for domains. References ISS X-Force Failed login attempt during restricted access hours http://xforce.iss.net/static/1501.php Login attempt failed for an unknown reason (Failed_loginunknown_error) About this signature or vulnerability This signature detects a Windows security log message indicating that a user has attempted to log in and been denied access for an unknown reason. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A user has attempted to log in and been denied access for an unknown reason. This event most likely indicates a system problem or a software failure, rather than intrusion or misuse. How to remove this vulnerability Determine why the user was denied access to the system. Check the system in question for software problems and determine if the account database has been corrupted. References ISS X-Force Login attempt failed for an unknown reason http://xforce.iss.net/static/1515.php 170 Finger bomb recursive request (Finger_Bomb) Finger bomb recursive request (Finger_Bomb) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected Finger Service Type Denial of Service Vulnerability description The system is vulnerable to a Finger Bomb attack. A Finger Bomb attack allows an attacker to disrupt your network using the redirection capability in the finger daemon. Some finger daemons allow redirecting a finger request to remote sites using the form finger username@hostname1@hostname2. The finger goes through hostname2, then to hostname1. This technique allows an attacker to conceal his presence, because hostname1 sees a finger coming from hostname2 instead of from the original service used by the attacker. Attackers have used this technique to penetrate improperly configured firewalls. This can happen by using the command finger user@host@firewall. An attacker could also use a recursive finger, such as finger username@hostname@hostname@hostname. Finger then call itself repeatedly, using increasing amounts of the system’s resources until the system has consumed all its resources. A similar denial of service attack may happen when an attacker types finger username@@@@@@@@@@@@@@@@@@@@@hostname1. The repeated @ causes finger to repeatedly finger the same system until the memory and hard drive swap space are consumed. This causes the system to stop or slow to an unusable speed. How to remove this vulnerability Disable finger, or install a version of finger that turns off redirection. GNU Finger can be configured to not allow redirection. In Unix: Disable the finger daemon. To disable a Unix daemon started from inetd: 1. Edit the /etc/inetd.conf (or equivalent) file. 2. Locate the line that controls the daemon. 3. Type a # at the beginning of the line to comment out the daemon. 4. Restart inetd. — OR — To turn off finger redirection, Unix systems can use GNU finger available from the GNU finger 1.37 download site. See References. Windows: Fingerd is not native to Windows, but may be present. To disable fingerd: 1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services. 2. Select the service. 3. Click Stop. 171 Finger perl attempt (Finger_Perl) 4. When the service has stopped, click Startup. 5. Choose one of these options: ■ To permanently disable the service, click Disabled. ■ To turn the service off unless manually activated by the user or a program, click Manual. 6. Click OK, then click Close. References FTP directory /pub/gnu/finger/ at prep.ai.mit.edu GNU finger 1.37 download ftp://prep.ai.mit.edu/gnu/finger/ NetworkICE AdvICE Database finger bomb http://www.toyo.co.jp/security/ice/advice_old/Exploits/Services/finger/ finger_bomb/default.htm ISS X-Force Finger bomb recursive request http://xforce.iss.net/static/47.php Finger perl attempt (Finger_Perl) Additional Vulnerabilities Found ■ dgux-fingerd ■ perl-fingerd Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.0, RealSecure Server Sensor: 5.5.2 Systems affected Perl fingerd: Old Versions Type Unauthorized Access Attempt Vulnerability description Finger perl attempt could be used to execute arbitrary commands. How to remove this vulnerability Upgrade to the most recent version of the Perl finger daemon. This vulnerability existed in the Perl finger daemon through version 0.2. Later versions should have corrected this problem. See perl-fingerd. For DG/UX fingerd, obtain the appropriate patch for your system, available from Data General. This problem has been reported as fixed in revision R4.11MU03 and later of DG/ UX. See dguz-fingerd. 172 Finger user (Finger_User) References ISS X-Force Finger perl attempt http://xforce.iss.net/static/4190.php Finger buffer overflow allows root access (Finger_RTM) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected BSD/OS: 2.x and earlier Type Unauthorized Access Attempt Vulnerability description Finger is a program used to discover the name associated with an email address, as well as other user information. The finger service is vulnerable to a buffer overflow. A remote attacker can overflow a buffer and execute arbitrary code on the system. This vulnerability could allow a remote attacker to gain root access. This vulnerability is named for Robert T. Morris, author of the Internet Worm that originally popularized this vulnerability. How to remove this vulnerability Upgrade to the latest version of your operating system. Consider disabling the finger service, which has a number of known vulnerabilities in addition to this buffer overflow. References Bill Maloy's Web site Morris Worm http://www.goldinc.com/html/maloy/SECURITY/morris_worm.html COAST Security FTP Archive Morris Worm article archive ftp://coast.cs.purdue.edu/pub/doc/morris_worm ISS X-Force Finger buffer overflow allows root access http://xforce.iss.net/static/641.php Finger user (Finger_User) About this signature or vulnerability This signature detects finger attempts and reports the user (or all users if the attempt was aimed at the whole computer) that the finger targeted. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 173 Forced Entry backdoor for Windows (ForcedEntry) Systems affected Finger Service Type Protocol Signature Vulnerability description Finger is a program used to discover the name associated with an email address, as well as other user information. Finger has a legitimate use, but is also often used by attackers to acquire information about a computer, such as account names, real names, and trusted hosts. Multiple finger requests in a short time period suggest brute force username or password guessing by an attacker. How to remove this vulnerability Determine if there have been other finger events from this same source address. A significant number of events (for example, more than 6) in a short time period (a minute) may indicate a username or password guessing attack by the source. Monitor this source closely for other signs of malicious intent, and block access for that address if this behavior continues. References ISS X-Force Finger user http://xforce.iss.net/static/646.php Forced Entry backdoor for Windows (ForcedEntry) About this signature or vulnerability This signature detects a TCP connection on port 9999 to a Forced Entry backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Forced Entry backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Forced Entry backdoor, an attacker can do the following: How to remove this vulnerability ● establish a telnet connection to your computer ● access files ● access your system registry To remove the Forced Entry backdoor from your computer: 1. Open C:\Windows\WIN.INI. 2. Find the line run=msreg32.exe. 174 Fore backdoor for Windows 95/98 (Fore) 3. Delete that line. 4. Delete Msreg32.exe from C:\Windows\System. References ISS X-Force Forced Entry backdoor for Windows http://xforce.iss.net/static/2387.php Fore backdoor for Windows 95/98 (Fore) About this signature or vulnerability This signature detects a TCP connection on port 50766 to a Fore backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Fore backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Fore backdoor, an attacker can do the following: ● execute programs ● retrieve system information ● restart the computer ● retrieve Dial-Up Networking accounts and passwords ● create, retrieve, and manipulate files using a built-in FTP server ● open and close your CD-ROM drive How to remove this vulnerability To remove the Fore backdoor from your computer, find and delete Fore.exe. References SECURED anti-trojan Web site F0re beta http://anti-trojan.virtualave.net/page35.html ISS X-Force Fore backdoor for Windows 95/98 http://xforce.iss.net/static/3354.php 175 Frenzy backdoor for Windows 95/98 (Frenzy) Freak88 allows a remote attacker to coordinate small-scale DDoS attacks (Freak88) About this signature or vulnerability This signature detects a command being sent from TCP port 7001 to a Freak88 server program on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows NT: 4.0, Windows 2000 Type Unauthorized Access Attempt Vulnerability description Freak88 is a simple server program that can allows attackers to use compromised systems as "zombies" for larger distributed denial of service (DDoS) attacks. Once installed on a system, a remote attacker can connect to the server and instruct it to launch a Ping flood against a specified IP address. An attack cannot be stopped by the attacker once it has been launched. How to remove this vulnerability To remove the Freak88 server from your computer: 1. Open the Task Manager. In Windows NT, press Ctrl+Alt+Del, and then click the Task Manager button. 2. Select the PROJECT1 program from the list. 3. Click the End Task button. Freak88 does not write to the registry or any other files, and it does not restart after its initial invocation. References TL Security Web site Freak88 http://www.tlsecurity.net/backdoor/freak88.htm ISS X-Force Freak88 allows a remote attacker to coordinate small-scale DDoS attacks http://xforce.iss.net/static/4850.php Frenzy backdoor for Windows 95/98 (Frenzy) About this signature or vulnerability This signature detects a TCP connection on port 1257 to a Frenzy backdoor on your network. Default risk level High 176 FSP daemon running (FSP_Detected) Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Frenzy backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Frenzy backdoor, an attacker can do the following: How to remove this vulnerability ● open and close your CD-ROM drive ● make your computer beep ● hide the taskbar ● move your mouse pointer ● restart your computer To remove the Frenzy backdoor from your computer: 1. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. 2. Find the registry entry named Explore that has a data value of C:\Windows\Msgsrv36.exe. 3. Delete this registry entry. 4. Delete Msgsrv36.exe from C:\Windows. References ISS X-Force Frenzy backdoor for Windows 95/98 http://xforce.iss.net/static/3100.php FSP daemon running (FSP_Detected) False positives RealSecure Network Sensor: The majority of FSP activity should be considered suspicious, but there may occasionally be legitimate uses. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.1 Systems affected Any, Solaris: 2.5.1, Solaris: 2.6, HP-UX: 10.20, Solaris: 7, Red Hat Linux: 6.0, Solaris: 8, AIX: 4.0, HP-UX: 11, Compaq: Tru64 UNIX Type Unauthorized Access Attempt 177 FSP daemon running (FSP_Detected) Vulnerability description A File Service Protocol (FSP) server has been detected as running. FSP is an alternative to FTP that transfers files using User Datagram Protocol (UDP). The majority of FSP activity should be considered suspicious. Use of FSP could allow an attacker to overwrite files. How to remove this vulnerability Investigate the FSP server and determine if its presence is legitimate. Remove the FSP server if it is not needed. Solaris: 2.5.1 Check to ensure that the specified user is authorized to run an FSP server on the system. Solaris: 2.6 Check to ensure that the specified user is authorized to run an FSP server on the system. HP-UX: 10.20 Check to ensure that the specified user is authorized to run an FSP server on the system. Solaris: 7 Check to ensure that the specified user is authorized to run an FSP server on the system. Red Hat Linux: 6.0 Check to ensure that the specified user is authorized to run an FSP server on the system. Solaris: 8 Check to ensure that the specified user is authorized to run an FSP server on the system. AIX: 4.0 Check to ensure that the specified user is authorized to run an FSP server on the system. HP-UX: 11 Check to ensure that the specified user is authorized to run an FSP server on the system. Compaq: Tru64 UNIX Investigate the FSP server and determine if its presence is legitimate. Remove the FSP server if it is not needed. References Internet FAQ Archives File Service Protocol (FSP) Frequently Asked Questions http://www.faqs.org/faqs/fsp-faq/ ISS X-Force FSP daemon running http://xforce.iss.net/static/304.php 178 AIX ftpd daemon buffer overflow (FTP_AIX_Overflow) FTGate Web interface allows remote attackers to read files from the system (HTTP_DotDot) About this signature or vulnerability This vulnerability is detected by the HTTP_DotDot signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected FTGate Type Unauthorized Access Attempt Vulnerability description Floosietek FTGate is a mail server for Windows 95, Windows 98, and Windows NT 4.0. FTGate 2.1 features a built-in Web server that allows administrators to use a Web browser to check the status of the mail server. A vulnerability in the FTGate Web interface could allow an attacker to use "dot dot" (/../) sequences to traverse directories and retrieve arbitrary files on the server. How to remove this vulnerability No remedy available as of April 2001. As a workaround, disable the FTGate Web interface. References Floosietek Ltd. Web site FTGate Mail Server Homepage http://www.floosietek.com/ eEye Digital Security Team Alert AD05261999 Multiple Web Interface Security Holes http://www.eeye.com/html/Research/Advisories/AD19990526.html ISS X-Force FTGate Web interface allows remote attackers to read files from the system http://xforce.iss.net/static/2241.php CVE CVE-1999-0887 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0887 AIX ftpd daemon buffer overflow (FTP_AIX_Overflow) About this signature or vulnerability This signature detects a specific FTP command that could overflow a buffer in the AIX ftpd daemon. False negatives RealSecure Network Sensor: RealSecure detects this attack when an attacker uses the exploit that was publicly released for this overflow attack. A false negative is possible if an 179 Ftpd args core dump (FTP_Args) attacker attempts to exploit this buffer overflow using code other than the published shell code. RealSecure Server Sensor: RealSecure detects this attack when an attacker uses the exploit that was publicly released for this overflow attack. A false negative is possible if an attacker attempts to exploit this buffer overflow using code other than the published shell code. Default risk level High Sensors that have this signature RealSecure Network Sensor: SR 1.1, RealSecure Server Sensor: 5.5.2 Systems affected AIX: 4.3 Type Unauthorized Access Attempt Vulnerability description Version 4.3 of the IBM AIX ftpd daemon is vulnerable to a buffer overflow. By using a specially formatted FTP command, a remote attacker can overflow a buffer in the ftpd daemon and execute arbitrary code on the system as root. How to remove this vulnerability Apply AIX APAR IY04477, or the temporary fix, as listed in IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1999:004.1. See References. References IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1999:004.1 Remote buffer overflow in ftpd daemon http://www-1.ibm.com/services/continuity/recover1.nsf/advisories/ C246FD0FCD6FB7988525680F0077E2E9/$file/sva004.txt CIAC Information Bulletin J-072 IBM AIX Buffer Overflow Vulnerability http://www.ciac.org/ciac/bulletins/j-072.shtml BugTraq Mailing List, Mon Sep 27 1999 23:03:18 Remote bufferoverflow exploit for ftpd from AIX 4.3.2 running on an RS6000 http://www.securityfocus.com/archive/1/28906 ISS X-Force AIX ftpd daemon buffer overflow http://xforce.iss.net/static/3758.php CVE CVE-1999-0789 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0789 Ftpd args core dump (FTP_Args) About this signature or vulnerability 180 This signature detects a specially-crafted command sent to the FTP daemon, which could indicate an attempt by an attacker to overflow the ftpd memory space and crash the system. FTP bounce attack could allow attackers to 'proxy' connections (FTP_Bounce) Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.0, RealSecure Server Sensor: 5.5 Systems affected FTP Type Unauthorized Access Attempt Vulnerability description Some FTP daemons are vulnerable to a denial of service attack caused by a buffer overflow core dump. By sending a malicious command to the FTP daemon, an attacker can overflow the ftpd memory space (an FTP core dump) and crash the system. FTP core dumps cause the ftpd memory space to become populated with usernames, encrypted passwords, or other system information that could be useful to an attacker in performing an attack. For example, using password information gained by this vulnerability, a remote attacker could log into the system or gain root access. How to remove this vulnerability Upgrade to the latest version of FTP (2.4.2 or later), available from the Academ Consulting Services Web site. See References. References Academ Consulting Services Web site WU-FTP Server Software Release Information http://ftp.academ.com/academ/wu-ftpd/release.html ISS X-Force Ftpd args core dump http://xforce.iss.net/static/201.php FTP bounce attack could allow attackers to 'proxy' connections (FTP_Bounce) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 5.5 Systems affected FTP Type Unauthorized Access Attempt Vulnerability description A normal FTP session occurs by establishing a connection to the FTP control port (TCP port 21). Once this control channel is established, any files to be sent are transferred using a separate connection (the data connection). This is done by the FTP client sending a PORT command containing the IP address and port that it will listen for a TCP connection on. The FTP server then connects back to that port and transfers the file. (There is also a mechanism called Passive FTP whereby the client connects to the server instead, but this method is not involved in this form of attack.) By specifying a different IP address than its own, an FTP client can trick some FTP servers into making a connection and sending data 181 FTP server command contains format string (FTP_Format_String) to another host on the network; that host will look like it is being probed or attacked by the FTP server when it fact it is the FTP client that is indirectly attacking it. This can mask an attacker's identity in attacking a network. It is also possible that an attacker could use this vulnerability to bypass some poorly configured packet filters or firewalls. For example, if the mail server allows telnet connections from an internal FTP server but not from external hosts on the Internet, an attacker may be able to connect to the telnet port on the SMTP server by "bouncing" through the FTP server. How to remove this vulnerability Upgrade to the latest version of your FTP server, which should include fixes for this problem. References Academ Consulting Services Web site WU-FTP Server Software Release Information http://ftp.academ.com/academ/wu-ftpd/release.html CERT Advisory CA-1997-27 FTP Bounce http://www.cert.org/advisories/CA-1997-27.html Hewlett-Packard Security Bulletin HPSBUX9511-028 Security Vulnerability in FTP http://us-support.external.hp.com/index.html ISS X-Force FTP bounce attack could allow attackers to 'proxy' connections http://xforce.iss.net/static/199.php CVE CVE-1999-0017 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0017 FTP server command contains format string (FTP_Format_String) About this signature or vulnerability Additional Vulnerabilities Found This signature detects an FTP protocol command with an argument that contains a 'printf()-style' format specifier. This event is highly indicative of an attacker's attempt to crash or otherwise execute code on a vulnerable FTP server, although it does not indicate whether or not the attack was successful. The command executed will be listed in the Command information field, along with its arguments. ■ wuftp-format-string-stack-overwrite Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2, RealSecure Server Sensor: 6.5 182 FTP get file (FTP_Get) Systems affected FTP Type Suspicious Activity Vulnerability description FTP (File Transfer Protocol) is a TCP-based protocol for transferring files between systems. Many FTP servers, such as earlier versions of wu-ftpd (Washington University FTP daemon), are vulnerable to format string attacks. In a format string attack, a remote attacker sends printf()-style format specifiers as arguments to certain commands. When a vulnerable FTP server attempts to process data that contains such format strings, the data can overwrite or corrupt portions of the stack. This type of attack could lead to system failure or allow an attacker to execute arbitrary code on your FTP server. How to remove this vulnerability Not all FTP servers are vulnerable to format string attacks. Contact your FTP server vendor to determine if your system is vulnerable to a format string attack. Upgrade to the latest version of your FTP server software, and apply any patches or updates that correct format string vulnerabilities. References ISS X-Force FTP server command contains format string http://xforce.iss.net/static/6182.php FTP get file (FTP_Get) About this signature or vulnerability This signature detects FTP GET requests to download files from an FTP server. This signature will report all files that are being transferred to the source host over FTP. In combination with the other FTP signatures, this signature can construct a log of all FTP activity, including date, time, username, and the names of the files transferred. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 Systems affected FTP Type Protocol Signature Vulnerability description In File Transfer Protocol (FTP), files being transferred from the destination host to the source host use a GET (technically, RECV) command to transfer the files. Such file transfer activity can be examined for compliance with your organization's acceptable use policies, or for suspicion of unauthorized disclosure of sensitive information. How to remove this vulnerability Determine the intent of the user in question if this file transfer activity is suspicious or is not in compliance with your organization's acceptable use policies. References ISS X-Force FTP get file http://xforce.iss.net/static/647.php 183 Multiple FTP servers glob(3) expansion buffer overflow (FTP_Glob_Expansion) Multiple FTP servers glob(3) expansion buffer overflow (FTP_Glob_Expansion) About this signature or vulnerability This signature detects a specially formatted FTP request whose first character is a tilde (~) and contains metacharacters (such as ~^$.|*+?()[]{}). Such an FTP request could indicate an attacker's attempt to overflow a buffer and execute arbitrary code on the FTP server. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.3 Systems affected HP-UX: 11.00, NetBSD, Solaris: 8, IRIX: 6.5.x, OpenBSD: 2.8, FreeBSD: 4.2, MIT Kerberos 5, Caldera UnixWare: 7 Type Unauthorized Access Attempt Vulnerability description Multiple FTP servers are vulnerable to a buffer overflow in the glob(3) function. The glob(3) function is used to expand short-hand notation into complete file names. By sending to the FTP server a request containing a tilde (~) as its first character with other wildcard characters in the pathname string, a remote attacker can overflow a buffer and execute arbitrary code on the FTP server to gain root privileges. Once the request is processed, the glob(3) function expands the user input, which could exceed the expected length. In order to exploit this vulnerability, the attacker must be able to create directories on the FTP server. How to remove this vulnerability For FreeBSD 4.2: Upgrade to the latest version of FreeBSD (FreeBSD 4.2-STABLE, FreeBSD 5.0-CURRENT, or later), as listed in CERT Advisory CA-2001-07. See References. For Fujitsu UXP/V: Apply the appropriate patch for your system, as listed in CERT Advisory CA-2001-07. See References. For NetBSD 1.4: Upgrade to the latest version of NetBSD (NetBSD-RELEASE-1-4 dated 4-04-2001 or later), as listed in NetBSD Security Advisory 2001-005. See References. For NetBSD 1.5: Upgrade to the latest version of NetBSD (NetBSD-RELEASE-1-5 dated 4-04-2001 or later), as listed in NetBSD Security Advisory 2001-005. See References. For NetBSD-Current: Upgrade to the latest version of NetBSD (NetBSD-Current dated 4-03-2001 or later), as listed in NetBSD Security Advisory 2001-005. See References. For Caldera UnixWare 7: Apply the appropriate patch for your system, as listed in Caldera International, Inc. Security Advisory CSSA-2001-SCO.27. See References. 184 Multiple FTP servers glob(3) expansion buffer overflow (FTP_Glob_Expansion) For other distributions: Contact your vendor for upgrade or patch information. References Network Associates, Inc. COVERT Labs Security Advisory #48 Globbing Vulnerabilities in Multiple FTP Daemons http://www.pgp.com/research/covert/advisories/048.asp CERT Advisory CA-2001-07 File Globbing Vulnerabilities in Various FTP Servers http://www.cert.org/advisories/CA-2001-07.html NetBSD Security Advisory 2001-005 (from SecurityFocus Archive) Ftpd denial of service and remote buffer overflow http://www.securityfocus.com/advisories/3207 FreeBSD, Inc. Security Advisory FreeBSD-SA-01:33 globbing vulnerability in ftpd ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:33.ftpdglob.v1.1.asc Kerberos Security Advisory 2001-04-25 KRB5 FTPD BUFFER OVERFLOWS http://web.mit.edu/kerberos/www/advisories/ftpbuf.txt CERT Vulnerability Note VU#808552 Multiple ftpd implementations contain buffer overflows http://www.kb.cert.org/vuls/id/808552 NetBSD Security Advisory 2000-018 One-byte buffer overrun in ftpd ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/advisories/NetBSD-SA2000018.txt.asc CIAC Information Bulletin L-070A FTP Filename Expansion Vulnerability http://www.ciac.org/ciac/bulletins/l-070.shtml CIAC Information Bulletin L-135 SGI File Globbing Vulnerability in ftpd http://www.ciac.org/ciac/bulletins/l-135.shtml SGI Security Advisory 20010802-01-P File globbing vulnerability in ftpd ftp://patches.sgi.com/support/free/security/advisories/20010802-01-P CIAC Information Bulletin L-129 Sun in.ftpd Filename Expansion Vulnerability http://www.ciac.org/ciac/bulletins/l-129.shtml Sun Microsystems, Inc. Security Bulletin #00205 in.ftpd http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/ 205&type=0&nav=sec.sba 185 Multiple FTP servers glob(3) implementation buffer overflow (FTP_Glob_Implementation) Caldera International, Inc. Security Advisory CSSA-2001-SCO.27 UnixWare 7: ftpd glob security ftp://stage.caldera.com/pub/security/unixware/CSSA-2001-SCO.27/CSSA-2001SCO.27.txt ISS X-Force Multiple FTP servers glob(3) expansion buffer overflow http://xforce.iss.net/static/6332.php CVE CAN-2001-0249 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0249 Multiple FTP servers glob(3) implementation buffer overflow (FTP_Glob_Implementation) About this signature or vulnerability This signature detects a specially formatted pattern string containing a set of brackets {} followed by an overly long string. Such a pattern string could indicate an attacker's attempt to overflow a buffer and execute arbitrary code on the FTP server. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.3 Systems affected HP-UX: 11.00, NetBSD, Solaris: 8, IRIX: 6.5.x, OpenBSD: 2.8, FreeBSD: 4.2, Caldera UnixWare: 7 Type Unauthorized Access Attempt Vulnerability description Multiple FTP servers employ a glob(3) function, which is used to expand shorthand notation into complete file names. Implementations of the c-shell globbing code are vulnerable to a buffer overflow. By supplying to the FTP server a pattern string containing a set of brackets {} followed by an overly long string, a remote attacker can overflow a buffer in the execbrc() function and execute arbitrary code on the FTP server. In order to exploit this vulnerability, the attacker must be able to create directories on the FTP server. How to remove this vulnerability For FreeBSD 4.2: Upgrade to the latest version of FreeBSD (FreeBSD 5.0-CURRENT, FreeBSD 4.2-STABLE, or FreeBSD 4.3-RELEASE, when it becomes available), as listed in CERT Advisory CA2001-07. See References. For Fujitsu UXP/V: Apply the appropriate patch for your system, as listed in CERT Advisory CA-2001-07. See References. For NetBSD 1.4: Upgrade to the latest version of NetBSD (NetBSD-RELEASE-1-4 dated 4-04-2001 or later), as listed in NetBSD Security Advisory 2001-005. See References. 186 Multiple FTP servers glob(3) implementation buffer overflow (FTP_Glob_Implementation) For NetBSD 1.5: Upgrade to the latest version of NetBSD (NetBSD-RELEASE-1-5 dated 4-04-2001 or later), as listed in NetBSD Security Advisory 2001-005. See References. For NetBSD-Current: Upgrade to the latest version of NetBSD (NetBSD-Current dated 4-03-2001 or later), as listed in NetBSD Security Advisory 2001-005. See References. For Caldera UnixWare 7: Apply the appropriate patch for your system, as listed in Caldera International, Inc. Security Advisory CSSA-2001-SCO.27. See References. For other distributions: Contact your vendor for upgrade or patch information. References Network Associates, Inc. COVERT Labs Security Advisory #48 Globbing Vulnerabilities in Multiple FTP Daemons http://www.pgp.com/research/covert/advisories/048.asp CERT Advisory CA-2001-07 File Globbing Vulnerabilities in Various FTP Servers http://www.cert.org/advisories/CA-2001-07.html NetBSD Security Advisory 2001-005 (from SecurityFocus Archive) Ftpd denial of service and remote buffer overflow http://www.securityfocus.com/archive/1/175233 CIAC Information Bulletin L-129 Sun in.ftpd Filename Expansion Vulnerability http://www.ciac.org/ciac/bulletins/l-129.shtml Sun Microsystems, Inc. Security Bulletin #00205 in.ftpd http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/ 205&type=0&nav=sec.sba Caldera International, Inc. Security Advisory CSSA-2001-SCO.27 UnixWare 7: ftpd glob security ftp://stage.caldera.com/pub/security/unixware/CSSA-2001-SCO.27/CSSA-2001SCO.27.txt Hewlett-Packard Security Bulletin HPSBUX0108-162 ftpd and ftp incorrectly manage buffers. http://itrc.hp.com CIAC Information Bulletin L-118 Hewlett-Packard ftpd and ftp Vulnerability http://www.ciac.org/ciac/bulletins/l-118.shtml ISS X-Force Multiple FTP servers glob(3) implementation buffer overflow http://xforce.iss.net/static/6333.php 187 NetTerm ftp 'dele' command buffer overflow (FTP_NetTerm_Dele_Overflow) FTP mkdir (FTP_Mkdir) About this signature or vulnerability This signature detects and records all user attempts to create new directories on an FTP server, whether successful or not. In combination with the other FTP signatures, this signature can construct a log of all FTP activity, including date, time, username, and the names of the files transferred. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected FTP Type Protocol Signature Vulnerability description The File Transfer Protocol (FTP) allows a user to create a new directory on the target computer. A directory created by a user with an "anonymous" username is indicative of suspicious activity. How to remove this vulnerability This activity should be examined for compliance with acceptable use policies, or for suspicion of unauthorized disclosure of sensitive information. References ISS X-Force FTP mkdir http://xforce.iss.net/static/648.php NetTerm ftp 'dele' command buffer overflow (FTP_NetTerm_Dele_Overflow) About this signature or vulnerability This signature detects a dele argument of 1024 characters or more being sent to the NetTerm FTP program. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected NetTerm NetFtpd Type Unauthorized Access Attempt Vulnerability description NetFtpd is an FTP server that is distributed as a part of NetTerm. The program is vulnerable to a buffer overflow in the dele command. By supplying a 1024 byte argument to the dele command, a remote attacker can overflow the buffer to crash the service and possibly execute arbitrary code on the system. 188 NetTerm ftp 'dir' command buffer overflow (FTP_NetTerm_Dir_Overflow) How to remove this vulnerability No remedy available as of July 2000. References Dragonmount Networks Advisory DNA-1999-001 NetTerm FTP Daemon http://www.dragonmount.net/security/dna/dna-1999-001.php ISS X-Force NetTerm ftp 'dele' command buffer overflow http://xforce.iss.net/static/3587.php NetTerm ftp 'dir' command buffer overflow (FTP_NetTerm_Dir_Overflow) About this signature or vulnerability This signature detects a dir argument of 1024 characters or more being sent to the NetTerm FTP program. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected NetTerm NetFtpd Type Unauthorized Access Attempt Vulnerability description NetFtpd is an FTP server that is distributed as a part of NetTerm. The program is vulnerable to a buffer overflow in the dir command. By supplying a 1024 byte argument to the dir command, a remote attacker can overflow the buffer to crash the service and possibly execute arbitrary code on the system. How to remove this vulnerability No remedy available as of July 2000. References Dragonmount Networks Advisory DNA-1999-001 NetTerm FTP Daemon http://www.dragonmount.net/security/dna/dna-1999-001.php ISS X-Force NetTerm ftp 'dir' command buffer overflow http://xforce.iss.net/static/3588.php 189 NetTerm ftp 'mkd' command buffer overflow (FTP_NetTerm_Mkd_Overflow) NetTerm ftp 'ls' command buffer overflow (FTP_NetTerm_Ls_Overflow) About this signature or vulnerability This signature detects an ls argument of 1024 characters or more being sent to the NetTerm FTP program. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected NetTerm NetFtpd Type Unauthorized Access Attempt Vulnerability description NetFtpd is an FTP server that is distributed as a part of NetTerm. The program is vulnerable to a buffer overflow in the ls command. By supplying a 1024 byte argument to the ls command, a remote attacker can overflow the buffer to crash the service and possibly execute arbitrary code on the system. How to remove this vulnerability No remedy available as of July 2000. References Dragonmount Networks Advisory DNA-1999-001 NetTerm FTP Daemon http://www.dragonmount.net/security/dna/dna-1999-001.php ISS X-Force NetTerm ftp 'ls' command buffer overflow http://xforce.iss.net/static/3589.php NetTerm ftp 'mkd' command buffer overflow (FTP_NetTerm_Mkd_Overflow) About this signature or vulnerability This signature detects an mkd argument of 1024 characters or more being sent to the NetTerm FTP program. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected NetTerm NetFtpd Type Unauthorized Access Attempt 190 NetTerm ftp 'pass' command buffer overflow (FTP_NetTerm_Pass_Overflow) Vulnerability description NetFtpd is an FTP server that is distributed as a part of NetTerm. The program is vulnerable to a buffer overflow in the mkd command. By supplying a 1024 byte argument to the mkd command, a remote attacker can overflow the buffer to crash the service and possibly execute arbitrary code on the system. How to remove this vulnerability No remedy available as of July 2000. References Dragonmount Networks Advisory DNA-1999-001 NetTerm FTP Daemon http://www.dragonmount.net/security/dna/dna-1999-001.php ISS X-Force NetTerm ftp 'mkd' command buffer overflow http://xforce.iss.net/static/3590.php NetTerm ftp 'pass' command buffer overflow (FTP_NetTerm_Pass_Overflow) About this signature or vulnerability This signature detects a pass argument of 1024 characters or more being sent to the NetTerm FTP program. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected NetTerm NetFtpd Type Unauthorized Access Attempt Vulnerability description NetFtpd is an FTP server that is distributed as a part of NetTerm. The program is vulnerable to a buffer overflow in the pass command. By supplying a 1024 byte argument to the pass command, a remote attacker can overflow the buffer to crash the service and possibly execute arbitrary code on the system. How to remove this vulnerability No remedy available as of July 2000. References Dragonmount Networks Advisory DNA-1999-001 NetTerm FTP Daemon http://www.dragonmount.net/security/dna/dna-1999-001.php ISS X-Force NetTerm ftp 'pass' command buffer overflow http://xforce.iss.net/static/3591.php 191 FTP password (FTP_Pass) NetTerm ftp 'rmdir' command buffer overflow (FTP_NetTerm_Rmdir_Overflow) About this signature or vulnerability This signature detects an rmdir argument of 1024 characters or more being sent to the NetTerm FTP program. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected NetTerm NetFtpd Type Unauthorized Access Attempt Vulnerability description NetFtpd is an FTP server that is distributed as a part of NetTerm. The program is vulnerable to a buffer overflow in the rmdir command. By supplying a 1024 byte argument to the rmdir command, a remote attacker can overflow the buffer to crash the service and possibly execute arbitrary code on the system. How to remove this vulnerability No remedy available as of July 2000. References Dragonmount Networks Advisory DNA-1999-001 NetTerm FTP Daemon http://www.dragonmount.net/security/dna/dna-1999-001.php ISS X-Force NetTerm ftp 'rmdir' command buffer overflow http://xforce.iss.net/static/3592.php FTP password (FTP_Pass) About this signature or vulnerability This signature detects all FTP logins and records the cleartext password used to log into the FTP server. This information is sensitive, and care should be taken to ensure that this information is not disclosed. This signature allows an administrator to log invalid password attempts, check passwords for strength against attack, and keep complete logs of activity. In combination with the other FTP decodes, this decode can construct a log of all FTP activity, including date, time, username, and the names of the files transferred. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 Systems affected FTP 192 Privileged port attack enabled on FTP server (FTP_PrivilegedBounce) Type Protocol Signature Vulnerability description In File Transfer Protocol (FTP), a cleartext password is passed across the network in order to authenticate that a user has access to files on the destination host. How to remove this vulnerability Multiple instances of this event in a short period of time might suggest that a brute force attack is underway. This activity should be examined for compliance with acceptable use policies, or for suspicion of unauthorized disclosure of sensitive information. References ISS X-Force FTP password http://xforce.iss.net/static/649.php Privileged port attack enabled on FTP server (FTP_PrivilegedBounce) About this signature or vulnerability This signature detects an FTP bounce attack against a privileged port. An FTP bounce attack against a non-privileged port may be caused by a type of FTP proxy, but an FTP bounce against a privileged port always indicates a malicious attempt to attack a network. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Solaris: 2.x, SunOS: 4.1.x, Windows 2000 Type Unauthorized Access Attempt Vulnerability description The FTP service specification allows passive connections to be established based on the port address given by the client. This configuration can allow attackers to execute destructive commands using the FTP service. The problem occurs when the FTP service connects using a port other than FTP Data port (port 20) and the port number is less than IP_PORT_RESERVED (ports less than 1024). In Microsoft Internet Information Server (IIS), the EnablePortAttack parameter is set by default to prevent a security problem in the FTP protocol specification. EnablePortAttack controls if such an attack should be allowed. By default, the service does not make any connections to port numbers lower than IP_PORT_RESERVED (other than port 20). If you want users to connect by using other ports as specified in the FTP RFC, this flag should be enabled in the registry. How to remove this vulnerability Upgrade to an FTP server that cannot establish connections to arbitrary systems. See References. For Windows NT/2000: 193 Privileged port attack enabled on FTP server (FTP_PrivilegedBounce) Use the Registry Editor (regedt32) to disable EnablePortAttack: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. From the Windows Start menu, select Run. 2. Type regedt32 and press Enter. This opens the Windows registry editor. 3. Find the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\FTPSVC\Parame ters registry key or the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSFTPSVC\Para meters registry key. 4. Set the EnablePortAttack value to zero. If you see this attack, determine the Host and Port involved. If this is one of your own hosts, you may want to check to see what was done to it. If this was a host that you do not own, the administrator of that system will see connections having originated from your FTP server, and if an attack was performed, your computer will appear to be the source of those attacks. You may wish to contact that administrator or at least save the logs of the original source of the attack should that administrator contact you in accordance with your security policies. Windows NT Set the registry key as follows: 1. From the Windows NT Start menu, select Run. 2. Type regedt32 and press Enter. This opens the Windows NT registry editor. 3. Go to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\FTPSVC\Parameters or HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSFTPSVC\Paramet ers registry key and if the EnablePortAttack value is nonzero, then set it to zero. Windows 2000 If you want users to connect by using other ports as specified in the FTP RFC, this flag should be enabled. Set the registry key. Set the registry key as follows: 1. From the Windows NT Start menu, select Run. 2. Type regedt32 and press Enter. This opens the Windows NT registry editor. 3. Go to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\FTPSVC\Parameters or HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSFTPSVC\Paramet ers registry key and if the EnablePortAttack value is nonzero, then set it to zero. References CERT Advisory CA-2001-04 Problems With The FTP PORT Command (Why You Don't Want Just Any PORT in a Storm) http://www.cert.org/tech_tips/ftp_port_attacks.html CERT Advisory CA-1997-27 FTP Bounce http://www.cert.org/advisories/CA-1997-27.html 194 FTP privileged port bounce can conceal attacker's identity (FTP_PrivilegedPort) Internet-Security.com Web site Internet-Security.com Web Site http://internet-security.com/lists/ciac/0014.html Microsoft Knowledge Base Article Q147621 IIS FTP Service Registry Parameters http://support.microsoft.com/support/kb/articles/q147/6/21.asp ISS X-Force Privileged port attack enabled on FTP server http://xforce.iss.net/static/945.php CVE CVE-1999-0017 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0017 FTP privileged port bounce can conceal attacker's identity (FTP_PrivilegedPort) About this signature or vulnerability This signature detects an FTP privileged port bounce, which could indicate an attacker's attempt to create the false appearance that the FTP server itself is staging an attack. An FTP Bounce attack to a non-privileged port is not as dangerous as an FTP Bounce attack to a privileged port. However, when an FTP Bounce attack occurs against a privileged port, it is highly indicative of an attack on the network. For this reason, the combined attack is added as a separate signature (FTP_PrivilegedBounce). False positives RealSecure Network Sensor: A false positive is possible if an FTP bounce that is not done to a privileged port is a result of a type of FTP proxy. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 5.5 Systems affected Solaris: 2.x, SunOS: 4.1.x Type Unauthorized Access Attempt Vulnerability description In a normal FTP (File Transfer Protocol) session, a connection is established to the FTP control port (TCP port 21). Once this control channel is established, any files to be sent are transferred on a separate connection (the data connection). The FTP client performs this procedure by sending a PORT command that contains the IP address, while the port listens for a TCP connection. The FTP server then connects back to that port and transfers the file. In an FTP Bounce attack, the FTP client specifies a different IP address than its own to trick some FTP servers into making a connection and sending data to another host on the network. This creates the appearance that the computer is being probed or attacked by the FTP server when in fact it is the FTP client that is indirectly attacking it. 195 FTP put file (FTP_Put) In a closely related attack, the FTP Privileged Port attack, an attacker specifies a legitimate IP address while using a privileged port for it connect back to. This allows an attacker on a multi-user system to attack her own computer while hiding her identity. This creates the appearance that the attack is originating from the FTP server. How to remove this vulnerability Check to see if your FTP server is vulnerable to the FTP bounce attack. (If you have Internet Scanner, run a scan against the FTP server and check if it comes up vulnerable to this.) Apply the appropriate patch for your system, as listed in CERT Advisory CA-1997-27. See References. As a workaround, if your FTP server is vulnerable, upgrade to the latest version of wuftpd (2.4.2-beta-16 or later), as listed in CERT Advisory CA-1997-27. See References. Also, examine the Host and Port that was connected to with the bounce attack. If this is one of your own hosts, you may want to check what was done to it. If this was a host that you do not own, be aware that the administrator of that computer can see connections having originated from your FTP server, and if an attack was performed, your computer appears to be the source of those attacks. You may want to contact that administrator or at least save the logs of the original source of the attack should that administrator contact you in accordance with their security policies. References CERT Coordination Center Tech Tips Problems With The FTP PORT Command or Why You Don't Want Just Any PORT in a Storm http://www.cert.org/tech_tips/ftp_port_attacks.html CERT Advisory CA-1997-27 FTP Bounce http://www.cert.org/advisories/CA-1997-27.html CIAC Information Bulletin I-018A FTP Bounce Vulnerability http://www.ciac.org/ciac/bulletins/i-018a.shtml Academ Consulting Services Web site WU-FTP Server Software Release Information http://ftp.academ.com/academ/wu-ftpd/release.html ISS X-Force FTP privileged port bounce can conceal attacker's identity http://xforce.iss.net/static/892.php CVE CVE-1999-0017 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0017 FTP put file (FTP_Put) About this signature or vulnerability 196 This signature detects FTP PUT requests to upload files to an FTP server. This signature also discovers all files that are being transferred to the destination host over FTP. In FTP CWD ~root login (FTP_Root) combination with the other FTP decodes, this decode can construct a log of all FTP activity, including date, time, username, and the names of the files transferred. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 2.0, RealSecure Server Sensor: 5.5.2 Systems affected FTP Type Protocol Signature Vulnerability description In File Transfer Protocol (FTP), files being transferred from the source host to the destination host use a PUT (technically STOR) command to transfer the files. FTP PUT decoding discovers all files that are being transferred to the destination host over FTP. How to remove this vulnerability This activity should be examined for compliance with acceptable use policies, or for suspicion of unauthorized disclosure of sensitive information. References ISS X-Force FTP put file http://xforce.iss.net/static/650.php FTP CWD ~root login (FTP_Root) About this signature or vulnerability This signature detects the use of the "CWD ~root" command, which may indicate an attempt by an attacker to gain root access to an FTP server. False positives RealSecure Network Sensor: A false positive is possible if a valid 'cd ~root' command is sent during an FTP session. However, this is extremely unlikely. It is much more likely that this signature is indicative of malicious intent. RealSecure Server Sensor: A false positive is possible if a valid 'cd ~root' command is sent during an FTP session. However, this is extremely unlikely. It is much more likely that this signature is indicative of malicious intent. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected FTP Type Unauthorized Access Attempt Vulnerability description Very old versions of the FTP daemon are vulnerable to unauthorized access by use of the "CWD ~root" command. By issuing a sequence of commands including the "CWD ~root" 197 FTP root login success detected (FTP_root_login) command, an attacker could bypass authentication on a vulnerable FTP server to gain root permissions and read, write, or transfer files. How to remove this vulnerability Replace the vulnerable FTP daemon with a more recent FTP package, such as wuftpd. Also, FTP daemons that are vulnerable to this attack are likely to have shipped with older operating systems. Consider upgrading to the latest available operating system supported by your hardware. References CERT Advisory CA-1988-01 ftpd vulnerability http://www.cert.org/advisories/CA-1988-01.html ISS X-Force FTP CWD ~root login http://xforce.iss.net/static/54.php CVE CVE-1999-0082 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0082 FTP root login success detected (FTP_root_login) About this signature or vulnerability This signature detects an entry in the wtmp binary file indicating that a root user has successfully authenticated to use FTP. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.0 Systems affected Solaris: 2.6, Solaris: 7, Solaris: 8 Type Host Sensor Vulnerability description A root user has successfully authenticated to use FTP. An attacker who logs in as root can view, modify, or delete any file on the system, or execute programs with root privileges. This would allow an attacker to perform many malicious actions against the system. How to remove this vulnerability Confirm that the FTP session is authorized. Use the time of the FTP session to help determine if this is legitimate administrative activity. If you suspect that an unauthorized FTP session has occurred, further investigation is warranted. Review the login history of users at the time of the FTP session. It may be necessary to contact any users in question. It is possible that an attacker has gained access to a valid user root FTP account and password. Require the users in question to change their passwords immediately. 198 FTP SITE EXEC can allow arbitrary command execution (FTP_Site_Exec_DotDot) References ISS X-Force FTP root login success detected http://xforce.iss.net/static/6021.php FTP site command (FTP_Site_Cmd) About this signature or vulnerability This signature detects the use of the FTP site command. Additional Vulnerabilities Found ■ wu-ftpd-exec False positives RealSecure Network Sensor: This event should not be considered an attack if it does not occur with a corresponding RealSecure SITE Exec .. or SITE Exec Tar event. Nevertheless, this is an unusual event. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected FTP Type Protocol Signature Vulnerability description The File Transfer Protocol (FTP) site command allows a user to execute certain commands on a destination host in addition to the normal FTP function of transferring files. In normal FTP usage, the FTP site command is rarely used. How to remove this vulnerability There may be legitimate reasons to execute site commands under certain circumstances. However, site commands can also be used by an attacker to gain access. Consequently, an administrator may want to view and log the site commands being executed to check for possible abuse. If you see this event, examine the FTP logs carefully to reconstruct this user's actions. References ISS X-Force FTP site command http://xforce.iss.net/static/651.php FTP SITE EXEC can allow arbitrary command execution (FTP_Site_Exec_DotDot) About this signature or vulnerability This signature detects a specially-crafted FTP SITE EXEC command, which may indicate an attempt by a remote attacker to execute arbitrary commands on the FTP server. 199 FTP Site Exec Tar allows remote access (FTP_Site_Exec_Tar) Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected wu-ftpd: 2.4.1 and earlier Type Unauthorized Access Attempt Vulnerability description Certain versions of wu-ftpd permit the use of a SITE EXEC command to execute commands on a remote system. By providing a pathname with certain characteristics, a remote attacker could execute arbitrary commands on the FTP server, which could aid the attacker in gaining root-level access on the victim system. How to remove this vulnerability Upgrade to the latest version of wu-ftp (2.4.2 or later), available from the Academ Consulting Services Web site. See References. References Academ Consulting Services Web site WU-FTP Server Software Release Information http://ftp.academ.com/academ/wu-ftpd/release.html CERT Advisory CA-1993-06 wuarchive ftpd Vulnerability http://www.cert.org/advisories/CA-1993-06.html CERT Advisory CA-1994-08 ftpd Vulnerabilities http://www.cert.org/advisories/CA-1994-08.html CERT Advisory CA-1995-16 wu-ftpd Misconfiguration Vulnerability http://www.cert.org/advisories/CA-1995-16.html ISS X-Force FTP SITE EXEC can allow arbitrary command execution http://xforce.iss.net/static/618.php CVE CVE-1999-0080 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0080 FTP Site Exec Tar allows remote access (FTP_Site_Exec_Tar) About this signature or vulnerability This signature detects a specially-crafted FTP SITE EXEC command that includes a command line option to the GNU tar program. This could indicate an attempt by a remote attacker to execute arbitrary commands on a vulnerable system. Default risk level High 200 FTP SYST command (FTP_Syst) Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected wu-ftpd: 2.4.1 and earlier Type Unauthorized Access Attempt Vulnerability description Certain versions of wu-ftpd permit the use of a SITE EXEC command to execute commands on a remote system. A command line option to the GNU tar program allows a user with FTP access to execute arbitrary commands on an FTP server by using the SITE EXEC command. This could allow a remote attacker to gain root-level access on the vulnerable system. How to remove this vulnerability Upgrade your FTP server or change to a different type of FTP server. References ISS X-Force FTP Site Exec Tar allows remote access http://xforce.iss.net/static/619.php CVE CVE-1999-0202 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0202 FTP SYST command (FTP_Syst) About this signature or vulnerability This signature detects a SYST command being issued to a File Transfer Protocol (FTP) server. False positives RealSecure Network Sensor: Some FTP clients such as Macintosh clients issue a SYST command on every connect to determine if the server supports certain desirable FTP extensions. RealSecure Server Sensor: Some FTP clients such as Macintosh clients issue a SYST command on every connect to determine if the server supports certain desirable FTP extensions. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 5.5 Systems affected FTP Type Pre-attack Probe Vulnerability description When a SYST command is issued to a File Transfer Protocol (FTP) server, the FTP server returns a response indicating the host operating system of the server. An attacker could 201 FTP user login success detected (FTP_user_login) use this information about the host operating system to customize an attack to exploit other potential vulnerabilities. How to remove this vulnerability Closely observe other activity on the target system following the SYST request. If this is a non-anonymous FTP server, ensure that the FTP server requires users to log in prior to honoring a SYST request. If anonymous access is allowed, consider disabling the SYST command. Refer to the documentation for your FTP server. References ISS X-Force FTP SYST command http://xforce.iss.net/static/1225.php FTP username (FTP_User) About this signature or vulnerability This signature records the username on the FTP server of the person transferring files. In combination with the other FTP decodes, this decode can construct a log of all FTP activity, including date, time, username, and the names of the files transferred. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 Systems affected FTP Type Protocol Signature Vulnerability description The File Transfer Protocol (FTP) allows users to transfer files between computers. Users must log in with a username and password to transfer files across the network. A username of "anonymous" is suspicious, as anyone can use an "anonymous" account. How to remove this vulnerability This activity should be examined for compliance with acceptable use policies, or for suspicion of unauthorized disclosure of sensitive information. References ISS X-Force FTP username http://xforce.iss.net/static/652.php FTP user login success detected (FTP_user_login) About this signature or vulnerability This signature detects an entry in the wtmp binary file indicating that a user has successfully authenticated to use FTP. Default risk level Low 202 FireWall-1 misconfiguration could allow attackers to manipulate filter modules (FW1_Auth_As_Local) Sensors that have this signature RealSecure Server Sensor: 6.0 Systems affected Solaris: 2.6, Solaris: 7, Solaris: 8 Type Host Sensor Vulnerability description A user has successfully authenticated to use FTP. Attackers often misuse systems by briefly logging in, initiating some inappropriate action, and then quickly logging off. Sometimes the attackers try to cover up the records of their presence. By maintaining a record of user logins, it is possible to display a record of the login events that occurred at the time of an attack. This audit history of logins can help you narrow the list of suspect user accounts. How to remove this vulnerability Confirm that the FTP session is authorized. Use the time of the FTP session to help determine if this is legitimate user activity. If you suspect that an unauthorized FTP session has occurred, further investigation is warranted. Review the login history of users at the time of the FTP session. It may be necessary to contact any users in question. It is possible that an attacker has gained access to a valid FTP account and password. Require the users in question to change their passwords immediately. References ISS X-Force FTP user login success detected http://xforce.iss.net/static/6022.php FireWall-1 misconfiguration could allow attackers to manipulate filter modules (FW1_Auth_As_Local) About this signature or vulnerability This signature detects traffic directed at TCP port 256 that could indicate an attempt by an attacker to bypass authentication by masquerading as the localhost. Default risk level High Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected Check Point Firewalls Type Unauthorized Access Attempt Vulnerability description Check Point FireWall-1 implements a number of authentication and encryption options for inter-module communication including FWA1, FWN1, S/Key, or none at all. A common misconfiguration is to not require authentication from the localhost address (127.0.0.1). Unfortunately, filter modules do not obtain this address information from the 203 FireWall-1 FWA1 authentication weakness (FW1_Auth_Replay) peer address of the TCP connection, but instead from the data stream received from the client. A remote attacker could use this to masquerade as the localhost and issue commands (such as unloading the policy) without being authenticated. How to remove this vulnerability For VPN-1/FireWall-1 4.0: Apply the latest Service Pack for your system (SP7 or later), as listed in the Check Point Technical Support Alert. See References. For VPN-1\FireWall-1 4.1: Apply the latest Service Pack for your system (SP2 or later), as listed in the Check Point Technical Support Alert. See References. For VPN-1 Appliances (IPSO) 4.0: Apply the SP5 Hotfix, as listed in the Check Point Technical Support Alert. See References. References Data Protect GmbH Web site A Stateful Inspection of FireWall-1 http://www.dataprotect.com/bh2000/ Check Point Technical Support Alert Potential Security Issues Recently Identified in VPN-1/FireWall-1 http://www.checkpoint.com/techsupport/alerts/list_vun.html#One-time_Password Internet Security Systems Security Alert #62 Multiple vulnerabilities on all platforms and versions of Check Point FireWall-1 http://xforce.iss.net/alerts/advise62.php CIAC Information Bulletin K-073 Multiple Vulnerabilities in Check Point Firewall-1 http://www.ciac.org/ciac/bulletins/k-073.shtml ISS X-Force FireWall-1 misconfiguration could allow attackers to manipulate filter modules http://xforce.iss.net/static/5137.php CVE CAN-2000-0808 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0808 FireWall-1 FWA1 authentication weakness (FW1_Auth_Replay) About this signature or vulnerability This signature detects an attempt to attack FireWall-1's FWA1 authentication protocol on TCP port 256. Default risk level Low Sensors that have this signature RealSecure Network Sensor: SR 1.1 204 FireWall-1 FWA1 authentication weakness (FW1_Auth_Replay) Systems affected Check Point FireWall-1: 3.0, Check Point FireWall-1: 4.0, Check Point FireWall-1: 4.1, Check Point FireWall-1: 4.1 SP1 Type Unauthorized Access Attempt Vulnerability description Check Point FireWall-1 implements a number of authentication and encryption options for inter-module communication, including the FWA1 protocol, which both authenticates and encrypts communication with a client. A flaw in this protocol could allow a remote attacker to replay a slightly modified challenge from a server to trick it into successfully authenticating the attacker. However, the attacker still does not have the encryption key necessary to continue communicating with the module and therefore cannot issue any commands. How to remove this vulnerability For VPN-1/FireWall-1 4.0: Apply the latest Service Pack for your system (SP7 or later), as listed in the Check Point Technical Support Alert. See References. For VPN-1\FireWall-1 4.1: Apply the latest Service Pack for your system (SP2 or later), as listed in the Check Point Technical Support Alert. See References. For VPN-1 Appliances (IPSO) 4.0: Apply the SP5 Hotfix, as listed in the Check Point Technical Support Alert. See References. References Data Protect GmbH Web site A Stateful Inspection of FireWall-1 http://www.dataprotect.com/bh2000/ Check Point Technical Support Alert Potential Security Issues Recently Identified in VPN-1/FireWall-1 http://www.checkpoint.com/techsupport/alerts/list_vun.html#Intermodule_Communications Internet Security Systems Security Alert #62 Multiple vulnerabilities on all platforms and versions of Check Point FireWall-1 http://xforce.iss.net/alerts/advise62.php CIAC Information Bulletin K-073 Multiple Vulnerabilities in Check Point Firewall-1 http://www.ciac.org/ciac/bulletins/k-073.shtml ISS X-Force FireWall-1 FWA1 authentication weakness http://xforce.iss.net/static/5162.php CVE CAN-2000-0806 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0806 205 FireWall-1 allows remote "get topology" requests without authentication (FW1_GetTopology) FireWall-1 allows remote "get topology" requests without authentication (FW1_GetTopology) About this signature or vulnerability This signature detects an unencrypted (and possibly unauthenticated) Get Topology (gettopo) request to a FireWall-1 module on TCP port 256. False positives RealSecure Network Sensor: RealSecure detects all unencrypted Get Topology requests, even from authenticated users. This does not necessarily indicate an attack, but could expose sensitive network topology information to a remote attacker. Default risk level Low Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected Check Point Firewalls Type Protocol Signature Vulnerability description The Check Point FireWall-1/VPN-1 SecuRemote client requires knowledge of a network's topology before it can negotiate a VPN (Virtual Private Network) connection. SecuRemote clients prior to version 4.0 do not encrypt or authenticate connections to the SecuRemote Server, which could expose possibly sensitive network topology information to remote attackers. The client and server of SecuRemote version 4.1 support string authentication and encryption of this data, but by default permit weaker, less secure connections for backward compatibility. An attacker could take advantage of these weaker connections to obtain sensitive network topology information. How to remove this vulnerability Disable the FireWall-1 option "Respond to Unauthenticated Cleartext Topology Requests". To disable this option from the FireWall-1 Policy Editor: 1. Open the FireWall-1 Policy Editor. 2. Select Policy —> Properties. 3. Click the Desktop Security tab. 4. Clear the "Respond to Unauthenticated Cleartext Topology Requests" check box. References ISS X-Force FireWall-1 allows remote "get topology" requests without authentication http://xforce.iss.net/static/5172.php 206 GateCrasher backdoor for Windows (GateCrasher) GateCrasher backdoor for Windows (GateCrasher) About this signature or vulnerability This signature detects a TCP connection on port 6969 to a GateCrasher backdoor on your network. False negatives RealSecure Network Sensor: RealSecure detects a connection to the GateCrasher backdoor only when the GateCrasher backdoor uses its default port, port 6969. A false negative is possible if the GateCrasher backdoor is configured to use a port other than 6969. RealSecure Server Sensor: RealSecure detects a connection to the GateCrasher backdoor only when the GateCrasher backdoor uses its default port, port 6969. A false negative is possible if the GateCrasher backdoor is configured to use a port other than 6969. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 6.5 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The GateCrasher 1.2 backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the GateCrasher 1.2 backdoor, an attacker can do the following: How to remove this vulnerability ● start and stop an FTP server on your computer ● restart your computer ● chat with other users on the system ● access files ● access your system registry To remove the GateCrasher backdoor from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. 2. Find the registry entry named Command that has a data value of C:\Windows\system.exe. 3. Delete this registry entry. 4. Delete system.exe from the Windows system directory. 207 Gauntlet Firewall CyberPatrol integration buffer overflow (Gauntlet_CyberDaemon_Overflow) References Internet Security Systems Security Alert #30 Windows Backdoor Update III http://xforce.iss.net/alerts/advise30.php ISS X-Force GateCrasher backdoor for Windows http://xforce.iss.net/static/2322.php Gauntlet Firewall CyberPatrol integration buffer overflow (Gauntlet_CyberDaemon_Overflow) About this signature or vulnerability This signature detects an oversized HTTP proxy request on TCP port 8999. This request will be reported in the "REQUEST" info field; the request's length will be reported in the "LENGTH" info field. An HTTP proxy request that contains binary data could indicate an attempt by an attacker to overflow a buffer in the Cyberdaemon component. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected Gauntlet Firewall: 5.0, Gauntlet Firewall: 5.5, Gauntlet Firewall: 4.2, Gauntlet Firewall: 4.1, WebShield: 100 Series, WebShield: 300 Series, WebShield: Solaris 4.0 Type Unauthorized Access Attempt Vulnerability description Network Associates Gauntlet, a multi-platform firewall system, is vulnerable to a buffer overflow in the CyberPatrol content monitoring system component. A remote attacker can overflow a buffer in the Gauntlet CyberPatrol component to crash the system and deny proxied HTTP connections to legitimate users or execute arbitrary code on the firewall with root privileges. How to remove this vulnerability Apply the appropriate "cyber.patch" for your system, available from the PGP Security Web site. See References. References PGP Security Web site Gauntlet Advisory – May 22, 2000 http://www.pgp.com/support/product-advisories/gauntlet.asp Garrison Technologies Gauntlet Vulnerability Discovered by Garrison Engineer http://www.garrison.com/html/gauntlet-article.html PGP Security Web site Gauntlet Firewall for Unix and WebShield cyberdaemon Buffer Overflow Vulnerability Advisory Addendum http://www.pgp.com/support/product-advisories/gauntlet.asp 208 Gauntlet ICMP packet denial of service (Gauntlet_ICMP_DoS) BugTraq Mailing List, Sun May 21 2000 22:36:05 Gauntlet CyberPatrol Buffer Overflow http://www.securityfocus.com/archive/1/61238 Gauntlet Support Web site Patch Status http://www.tis.com/support/patchpage.html ISS X-Force Gauntlet Firewall CyberPatrol integration buffer overflow http://xforce.iss.net/static/4503.php CVE CVE-2000-0437 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0437 Gauntlet ICMP packet denial of service (Gauntlet_ICMP_DoS) About this signature or vulnerability This signature detects a specially-crafted ICMP Protocol Problem packet that could indicate an attempt by a remote attacker to stall the Gauntlet firewall. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected Gauntlet Firewall: 5.0 Type Denial of Service Vulnerability description Network Associates Gauntlet Firewall version 5.0 is vulnerable to a denial of service attack. A remote attacker could stall the firewall by submitting a specially-crafted ICMP Protocol Problem packet to a computer routed through the firewall. How to remove this vulnerability Apply the kernel.BSDI.patch, available from the PGP Security Web site. See References. References BugTraq Mailing List, Thu Jul 29 1999 22:03:07 Remotely Lock Up Gauntlet 5.0 http://www.securityfocus.com/archive/1/20276 PGP Security Web site Current Gauntlet 5.0 Patch Status http://www.pgp.com/naicommon/download/upgrade/patches/patchgauntlet50unix.asp ISS X-Force Gauntlet ICMP packet denial of service http://xforce.iss.net/static/3108.php 209 GayOL backdoor for Windows and AOL (GayOL) CVE CVE-1999-0683 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0683 GayOL backdoor for Windows and AOL (GayOL) About this signature or vulnerability This signature detects a GayOL client attempting to connect to a GayOL server on UDP port 692. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The GayOL backdoor program allows attackers to take control of a user's AOL (America Online) session on an infected system. When the user of an infected system logs into AOL, the GayOL backdoor notifies the attacker by ICQ of the user's IP address. The attacker can then use a special client that operates over UDP port 692 to connect to the system and perform a number of functions such as: ● retrieve and set AOL passwords ● manipulate the user's AOL mailbox ● manipulate the user's Instant Message and Chat sessions The GayOL backdoor server on UDP port 692 only becomes active when the user logs into AOL. How to remove this vulnerability To remove the GayOL backdoor from an infected computer: 1. If the infected system is currently logged into AOL, log off. 2. Delete the file C:\Windows\Start Menu\Programs\StartUp\winsystray8876.exe 3. Delete the file C:\Windows\System\gaoltray.exe 4. Restart the computer. References ISS X-Force GayOL backdoor for Windows and AOL http://xforce.iss.net/static/5328.php 210 GirlFriend backdoor for Windows (GirlFriend) Buffer overflows can lead to arbitrary command execution (Generic_Intel_Overflow) About this signature or vulnerability This signature detects NOPS instructions. If NOPS instructions are found, it looks for syscall traps for that type of architecture, which could allow an attacker to gain access to your system. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2 Systems affected Any Type Denial of Service Vulnerability description In buffer overflow attacks, an attacker supplies data that is longer than the available space to hold it. For stack allocated variables, this usually means the attacker can corrupt other variables and eventually modify the code that is executed when the function in which the overflow occurs ends. How to remove this vulnerability Block access to hosts or networks launching these attacks. This event may indicate an attack based on previously released vulnerabilities in a server, or an attack on unpublished security vulnerabilities. If possible, remove the attacked server from the network and determine any vulnerabilities it may have. References Nathan P. Smith Web site Smashing the Stack http://reality.sgi.com/nate/machines/security/ ISS X-Force Buffer overflows can lead to arbitrary command execution http://xforce.iss.net/static/2189.php GirlFriend backdoor for Windows (GirlFriend) About this signature or vulnerability This signature detects a TCP connection on port 21554 to a GirlFriend backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows 95, Windows 98 211 Glacier backdoor for Windows (Glacier) Type Unauthorized Access Attempt Vulnerability description The GirlFriend backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the GirlFriend backdoor, an attacker can do the following: How to remove this vulnerability ● access files on your hard drive ● capture your keystrokes ● retrieve your passwords by monitoring the password fields in dialog boxes on your screen To remove the GirlFriend backdoor from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. 2. Find the registry entry named Windll.exe. The entry's data value contains the path to the GirlFriend program file, Windll.exe. Remember the location of the file. 3. Restart your computer in MS-DOS mode. 4. Delete the Windll.exe file from the path named in the registry value. 5. Restart Windows. 6. Using Regedit, delete the Windll.exe entry from the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. References Internet Security Systems Security Alert #30 Windows Backdoor Update III http://xforce.iss.net/alerts/advise30.php ISS X-Force GirlFriend backdoor for Windows http://xforce.iss.net/static/2324.php Glacier backdoor for Windows (Glacier) About this signature or vulnerability This signature detects a TCP connection (traffic destined to TCP port 7626 or originating from TCP port 7718) to a Glacier backdoor on your network. False positives RealSecure Network Sensor: A false positive is possible if other services are operating on the Glacier client/server ports, though this is very unlikely. Default risk level High 212 Glacier backdoor for Windows (Glacier) Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows NT, Windows 95, Windows 98, Windows 2000 Type Unauthorized Access Attempt Vulnerability description The Glacier backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Glacier backdoor, an attacker can do the following: ● modify the registry ● shut down your computer ● view your computer's screen ● record passwords ● obtain system information ● manipulate files on your computer By default, the Glacier backdoor copies two files, Kernel32.exe and SysExplr.exe, onto the victim computer. Kernel32.exe is the server program, and SysExplr.exe is a backup of the server program that could re-infect the system when a user opens a text file. The Glacier backdoor program names, locations, and ports can be configured by the attacker, which can make detection and removal difficult. How to remove this vulnerability To remove the Glacier backdoor from your computer: CAUTION: Use Registry Editor at your own risk. Any change made with Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the following two registry entries: ■ HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\(Default) ■ HKLM\Software\Microsoft\Windows\CurrentVersion\Run\(Default) The data value for one or both of the entries should contain the path to the Glacier program file, usually Kernel32.exe. This file is located in the Windows System directory by default. If both registry entries contain the same file name, but it it is not Kernel32.exe, it is probably the Glacier program file. Remember the name and location of this file. 2. Delete the registry entry or entries that contain the path to the Glacier program file. 3. Delete the file found in the registry entry. 4. Using Regedit, find the HKLM\Software\Classes\txtfile\shell\open\command\(Default) registry entry. If the entry's data value is not "<Path to Notepad>\NOTEPAD.EXE %1", it contains the path to a backup copy of the Glacier program file, usually SysExplr.exe. This file is located in the Windows System directory by default. Remember the name and location of this file. 213 Global group access or privileges modified (Global_group_changed) 5. Change the registry entry's data value to the location of the Windows Notepad program: "<Path to Notepad>\NOTEPAD.EXE %1". 6. Delete the file you identified in step 5. References CIAC Information Bulletin L-077 The Glacier Backdoor http://www.ciac.org/ciac/bulletins/l-077.shtml ISS X-Force Glacier backdoor for Windows http://xforce.iss.net/static/4339.php Global group access or privileges modified (Global_group_changed) About this signature or vulnerability This signature detects a Windows security log message indicating that access to or privileges for a global group have been modified. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A global group is a named collection of user accounts that is visible to any computer participating in a domain. Global groups may only contain user accounts from one domain. The three predefined global groups for a Windows NT domain are Domain Administrators, Domain Users, and Domain Guests. Typically these global groups only apply to Windows NT domains set up on a primary domain controller. Any management performed on the global group will result in Windows NT writing an audit message to the security event log. Any changes made to a global group can have consequences for all the computers in the domain in question. An attacker that has gained access can alter the membership of a global group to allow accounts access and privileges never intended by the administrator. How to remove this vulnerability If it has been determined that a system has been compromised, an inspection of the global group audit events can determine the degree to which an attacker may have created access to other systems. You can review the administrative activity history by running the Windows NT Admin Activity Report. References ISS X-Force Global group access or privileges modified http://xforce.iss.net/static/1526.php 214 Global group deleted from the domain (Global_group_deleted) Global group created on the domain (Global_group_created) About this signature or vulnerability This signature detects a Windows security log message indicating that a global group has been created on the domain. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A global group is a named collection of user accounts that is visible to any computer participating in a domain. Global groups may only contain user accounts from one domain. The three predefined global groups for a Windows NT domain are Domain Administrators, Domain Users, and Domain Guests. Typically these global groups only apply to Windows NT domains set up on a primary domain controller. Any management performed on the global group will result in an audit message being written to the security event log. Any changes made to a global group can have consequences for all the computers in the domain in question. An attacker who has gained access can alter the membership of a global group to allow accounts access and privileges never intended by the administrator. How to remove this vulnerability If it has been determined that a system has been compromised, an inspection of the global group audit events can determine the degree to which an attacker may have created access to other systems. References ISS X-Force Global group created on the domain http://xforce.iss.net/static/1518.php Global group deleted from the domain (Global_group_deleted) About this signature or vulnerability This signature detects a Windows security log message indicating that a global group has been deleted from the domain. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT 215 Global group membership modified - user added (Global_group_user_added) Type Host Sensor Vulnerability description A global group is a named collection of user accounts that is visible to any computer participating in a domain. Global groups may only contain user accounts from one domain. The three predefined global groups for a Windows NT domain are Domain Administrators, Domain Users, and Domain Guests. Typically these global groups only apply to Windows NT domains set up on a primary domain controller. Any management performed on the global group will result in Windows NT writing an audit message to the security event log. Any changes made to a global group can have consequences for all the computers in the domain in question. An attacker that has gained access can alter the membership of a global group to allow accounts access and privileges never intended by the administrator. How to remove this vulnerability If it has been determined that a system has been compromised, an inspection of the global group audit events can determine the degree to which an attacker may have created access to other systems. You can review the administrative activity history by running the Windows NT Admin Activity Report. References ISS X-Force Global group deleted from the domain http://xforce.iss.net/static/1527.php Global group membership modified - user added (Global_group_user_added) About this signature or vulnerability This signature detects a Windows security log message indicating that a user has been added to a global group. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A global group is a named collection of user accounts that is visible to any computer participating in a domain. Global groups may only contain user accounts from one domain. The three predefined global groups for a Windows NT domain are Domain Administrators, Domain Users, and Domain Guests. Typically these global groups only apply to Windows NT domains set up on a primary domain controller. Any management performed on the global group will result in Windows NT writing an audit message to the security event log. 216 Global group membership modified - user removed (Global_group_user_removed) Any changes made to a global group can have consequences for all the computers in the domain in question. An attacker that has gained access can alter the membership of a global group to allow accounts access and privileges never intended by the administrator. How to remove this vulnerability If it has been determined that a system has been compromised, an inspection of the global group audit events can determine the degree to which an attacker may have created access to other systems. You can review the administrative activity history by running the Windows NT Admin Activity Report. References ISS X-Force Global group membership modified - user added http://xforce.iss.net/static/1528.php Global group membership modified - user removed (Global_group_user_removed) About this signature or vulnerability This signature detects a Windows security log message indicating that a user has been removed from a global group. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A global group is a named collection of user accounts that is visible to any computer participating in a domain. Global groups may only contain user accounts from one domain. The three predefined global groups for a Windows NT domain are Domain Administrators, Domain Users, and Domain Guests. Typically these global groups only apply to Windows NT domains set up on a primary domain controller. Any management performed on the global group will result in Windows NT writing an audit message to the security event log. Any changes made to a global group can have consequences for all the computers in the domain in question. An attacker that has gained access can alter the membership of a global group to allow accounts access and privileges never intended by the administrator. How to remove this vulnerability If it has been determined that a system has been compromised, an inspection of the global group audit events can determine the degree to which an attacker may have created access to other systems. You can review the administrative activity history by running the Windows NT Admin Activity Report. References ISS X-Force Global group membership modified - user removed http://xforce.iss.net/static/1529.php 217 Gnutella Download (Gnutella_Download) Gnutella Connection (Gnutella_Connect) About this signature or vulnerability This signature detects a connection between a Gnutella client and a Gnutella server. False positives RealSecure Network Sensor: RealSecure detects all occurrences of the string “GNUTELLA CONNECT” on any port. Although highly unlikely, a false positive is possible if this string occurs in network communications not associated with a Gnutella connection. Default risk level Low Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected Gnutella Type Protocol Signature Vulnerability description Gnutella is a tool for general peer-to-peer file sharing, similar to the popular Napster program, but without a centralized server. The Gnutella protocol is well documented on the Internet, making it possible for an attacker to create a customized, malicious Gnutella application with backdoor features. In addition, files shared from other Gnutella users could contain viruses or other backdoor programs. How to remove this vulnerability If use of Gnutella is not in compliance with your system policy, consider terminating the connection associated with this Gnutella event. It may be helpful to remind users of your system policy regarding the use of Gnutella or similar applications. References Gnutella Web site Welcome to Gnutella http://gnutella.wego.com/ ISS X-Force Gnutella Connection http://xforce.iss.net/static/4820.php Gnutella Download (Gnutella_Download) About this signature or vulnerability This signature detects a Gnutella file transfer. False positives RealSecure Network Sensor: A false positive is possible if the string “GET /get/” appears over the network, in which case it will be identified as a Gnutella download. Also, it is possible for web transfers to be identified as Gnutella transfers if they have a 'get' directory under the http root. 218 Gnutella Worm (Gnutella_Worm) Default risk level Low Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected Gnutella Type Suspicious Activity Vulnerability description Gnutella is a tool for general peer-to-peer file sharing, similar to the popular Napster program, but without a centralized server. The Gnutella protocol is well documented on the Internet, making it possible for an attacker to create a customized, malicious Gnutella application with backdoor features. In addition, files shared from other Gnutella users could contain viruses or other backdoor programs. How to remove this vulnerability If use of Gnutella is not in compliance with your system policy, consider terminating the connection associated with this Gnutella event. It may be helpful to remind users of your system policy regarding the use of Gnutella or similar applications. References Gnutella Web site Welcome to Gnutella http://gnutella.wego.com/ ISS X-Force Gnutella Download http://xforce.iss.net/static/4821.php Gnutella Worm (Gnutella_Worm) About this signature or vulnerability This signature detects a Gnutella download containing a .vbs (Visual Basic Script) file, which could install the Gnutella worm, or another virus, if executed. False positives RealSecure Network Sensor: A false positive is possible if the .vbs file in the Gnutella download does not contain the Gnutella worm. However, any downloaded .vbs file should be considered suspicious. Default risk level High Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected Gnutella Type Suspicious Activity Vulnerability description The Gnutella worm is a virus program which, if installed on your computer, can send copies of itself to other computers that use the Gnutella application. Gnutella is a tool for 219 Windows 2000 group type change (Group_type_changed) general peer-to-peer file sharing, similar to the popular Napster program, but without a centralized server. How to remove this vulnerability If use of Gnutella is not in compliance with your system policy, consider terminating the connection associated with this Gnutella event, or uninstalling the Gnutella application. It may be helpful to remind users of your system policy regarding the use of Gnutella or similar applications. Additionally, educate users about the dangers of executing untrusted content. References Gnutella Web site Welcome to Gnutella http://gnutella.wego.com/ ISS X-Force Gnutella Worm http://xforce.iss.net/static/4822.php Windows 2000 group type change (Group_type_changed) About this signature or vulnerability This signature detects a Windows event log message indicating that a group type has been changed. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Windows 2000 Type Host Sensor Vulnerability description The group type of a Windows 2000 group has been changed. The two group types used in Windows 2000 are security groups and distribution groups. While security groups assign access rights and privileges to groups of users, distribution groups are used to perform non-security functions in applications that use Active Directory. Because the purposes of each group type are very different, any group type change should be considered a suspicious event. How to remove this vulnerability Verify that the group type change was authorized. If necessary, undo the change. References ISS X-Force Windows 2000 group type change http://xforce.iss.net/static/4855.php 220 Hack'a'Tack backdoor for Windows (HackATack) Logon event by a Guest user (Guest_user_login) About this signature or vulnerability This signature detects a security log message indicating that a guest user has logged on to the system. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Solaris, Unix, Windows NT Type Host Sensor Vulnerability description Some system administrators allow a guest account on their systems. A casual or one-time user often uses such a guest account. When a guest logs into the system, an event message is written to the security log. In Windows NT/2000, this event is generated when a Windows NT/2000 security event ID = 528 occurs and the word "guest" is in the event information. In Solaris, this event is generated when a guest logs in using login, rlogin, or telnet. Guest accounts are essentially anonymous. For this reason, all guest accounts should be considered suspicious. How to remove this vulnerability Frequently, an administrator will be unaware of a guest account being enabled on a system. This event message indicates not only that a guest account exists, but that it is also in use. It is strongly recommended that all guest accounts be disabled. Guest accounts can be the open door through which an attacker makes an initial entrance onto a system. If a guest account is enabled, the administrator should be careful in setting up the guest account and making sure that it does not provide an entry point for an attacker. References ISS X-Force Logon event by a Guest user http://xforce.iss.net/static/1788.php Hack'a'Tack backdoor for Windows (HackATack) About this signature or vulnerability This signature detects a TCP connection on port 31785 to a Hack'a'Tack backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 221 Hacker's Paradise backdoor for Windows 95/98 and NT (HackersParadise) Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Hack'a'Tack backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Hack'a'Tack backdoor, an attacker can do the following: How to remove this vulnerability ● move and close windows on your desktop ● start an FTP server on your computer ● log your keystrokes, including passwords you type ● shut down the computer ● execute programs To remove the Hack'a'Tack backdoor from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. 2. Find the registry entry named Explorer32. The entry's data value contains the path to the Hack'a'Tack program file, Expl32.exe. Remember the location of the file. 3. Restart your computer in MS-DOS mode. 4. Delete the Expl32.exe file from the path named in the registry value. 5. Restart Windows. 6. Using Regedit, delete the Expl32.exe entry from the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. References Internet Security Systems Security Alert #30 Windows Backdoor Update III http://xforce.iss.net/alerts/advise30.php ISS X-Force Hack'a'Tack backdoor for Windows http://xforce.iss.net/static/2325.php Hacker's Paradise backdoor for Windows 95/98 and NT (HackersParadise) About this signature or vulnerability This signature detects a TCP connection on port 456 to a Hacker's Paradise backdoor on your network. Default risk level High 222 Host Control backdoor for Windows (HostControl) Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Hacker's Paradise backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Hacker's Paradise backdoor, an attacker can do the following: How to remove this vulnerability ● access files on your computer ● manipulate the appearance of your desktop ● retrieve RAS (Remote Access Server) passwords (Windows NT only) To remove the Hacker's Paradise backdoor from your computer: 1. Stop the Hacker's Paradise program (Antihack.exe) from running. Open the task list by following the steps below for your platform: ■ In Windows 95/98, press Ctrl+Alt+Del to display the Close Programs dialog box. ■ In Windows NT, press Ctrl+Alt+Del, then click the Task Manager button to start the NT Task Manager. 2. Select Antihack.exe, and then click End Task. If Antihack.exe does not appear in the list, the backdoor is using a different file name and could be very difficult to locate. Refer to the steps below for using an antivirus program to remove the backdoor. 3. Find and delete the file Antihack.exe. To use an antivirus program to remove the Hacker's Paradise backdoor: 1. If you do not have an antivirus program installed, download and install one of these virus scanners: ■ Norton AntiVirus: http://www.symantec.com/nav/indexA.html ■ McAfee VirusScan: http://software.mcafee.com/centers/download/ ■ Trend Micro PC-Cillin: http://www.trend.com/pc-cillin/ 2. Run the antivirus program to scan your system for this backdoor. The virus scanner should find and remove the Hacker's Paradise backdoor from your computer. References ISS X-Force Hacker's Paradise backdoor for Windows 95/98 and NT http://xforce.iss.net/static/3113.php Host Control backdoor for Windows (HostControl) About this signature or vulnerability This signature detects a TCP connection on port 11051 to a Host Control backdoor on your network. 223 Host Control backdoor for Windows (HostControl) Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Host Control backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. On an infected system, the Host Control server listens on port 11051 for Host Control client connections. Once connected, a Host Control client can manipulate files and retrieve passwords on the infected system. How to remove this vulnerability To remove the Host Control backdoor from your computer: CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. In Windows 95/98, press Ctrl+Alt+Del to display the Close Programs dialog box. 2. Select the Winoldap program from the list. 3. Click the End Task button. (There may be more than one instance of Winoldap on the list. Click the End Task button for each instance.) 4. Using Regedit, find the HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run registry key. 5. Find the registry entry named ICQNetDetect that has a data value of C:\Recycled\temp.exe. 6. Delete this registry entry. 7. Find the registry entry named WinKernel that has a data value of C:\Recycled\winkernel.exe. 8. Delete this registry entry. 9. Find the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key. 10. Repeat steps 5 through 8 for this registry key. 11. Delete C:\Recycled\temp.exe and C:\Recycled\winkernel.exe. 12. Restart your computer. 224 HP OpenView hidden SNMP community (HP_OpenView_SNMP_Backdoor) These instructions were tested for Host Control version 2.6. For other possible versions of the Host Control backdoor, you may wish to use an antivirus program to remove the Host Control backdoor: 1. If you do not have an antivirus program installed, download and install one of these virus scanners: ■ Norton AntiVirus: http://www.symantec.com/nav/indexA.html ■ McAfee VirusScan: http://software.mcafee.com/centers/download/ ■ Trend Micro PC-Cillin: http://www.trend.com/pc-cillin/ 2. Run the antivirus program to scan your system for this backdoor. The virus scanner should find and remove the Host Control backdoor from your computer. References ISS X-Force Host Control backdoor for Windows http://xforce.iss.net/static/5329.php HP OpenView hidden SNMP community (HP_OpenView_SNMP_Backdoor) About this signature or vulnerability False positives This signature detects the use of a specific, hidden SNMP community string that has readwrite access to the configuration of HP OpenView 4.x and 5.x management Agents. RealSecure Network Sensor: A false positive is possible for legitimate use of the hidden SNMP community string. RealSecure Server Sensor: A false positive is possible for legitimate use of the hidden SNMP community string. Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 6.5 Systems affected HP-UX: 9.x, Solaris: 2.x, HP-UX: 10.x, HP-UX: 11.00 Type Unauthorized Access Attempt Vulnerability description Internet Security Systems' (ISS) X-Force has researched a hidden SNMP community string that exists in the HP OpenView 4.x and 5.x management Agent. This community string has read-write access to the Agent configuration and may allow unauthorized access to certain SNMP variables. Attackers may use this hidden community string to learn about network topology as well as modify MIB variables. This vulnerability is present in HP OpenView version 5.02. Earlier versions are believed to be vulnerable. SNMP agents for HP-UX 9.x, 10.x, 11.0 and Solaris 2.x are vulnerable. OpenView for Windows NT is not vulnerable. 225 HP-UX rlpd print protocol daemon buffer overflow (HPUX_RLPD_Overflow) How to remove this vulnerability References Apply the following patches, as listed in Hewlett-Packard Security Bulletin HPSBUX9811088. See References. ● PHSS_16846 (HP-UX 11.00) ● PHSS_16845 (HP-UX 10.20) ● PHSS_16800 (HP-UX 10.0x and 10.10) ● PHSS_16799 (HP-UX 9.x) ● PSOV_02190 (Solaris 2.3 and 2.4) ● PSOV_02191 (Solaris 2.5.1 and 2.6) Internet Security Systems Security Alert #12 Hidden SNMP community in HP OpenView http://xforce.iss.net/alerts/advise12.php Hewlett-Packard Security Bulletin HPSBUX9811-088 Security Vulnerability with snmp http://us-support.external.hp.com/index.html ISS X-Force HP OpenView hidden SNMP community http://xforce.iss.net/static/1387.php CVE CAN-1999-0516 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0516 HP-UX rlpd print protocol daemon buffer overflow (HPUX_RLPD_Overflow) About this signature or vulnerability This signature detects an unusually long "6" command request sent to the lpd daemon. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.3 Systems affected HP-UX: 10.01, HP-UX: 10.10, HP-UX: 11.00, HP-UX: 10.20, HP-UX: 11.11, HP-UX: 11.20 Type Unauthorized Access Attempt Vulnerability description Many commercial and open-source operating systems are adapted from BSD Unix. HPUX is shipped with a line printer daemon adapted from BSD Unix that is similar to in.lpd in other Unix variants. The Line Printer Daemon is used to allow heterogeneous Unix environments to share printers over a network. 226 HP-UX rlpd print protocol daemon buffer overflow (HPUX_RLPD_Overflow) The HP-UX rlpdaemon is vulnerable to a denial of service attack caused by a buffer overflow. By sending a specially-crafted print request, an attacker can crash the service or execute arbitrary code with superuser privilege on the target system. This vulnerability is particularly serious because rlpdaemon is installed and configured by default and is active even if it is not being used. An attacker requires no local account or knowledge of the configuration on the target system to successfully exploit this vulnerability. All current versions of HP-UX install and enable the rlpdaemon daemon by default. How to remove this vulnerability For HP-UX 10.01, 10.10, 10.20, 11.00, 11.11, and 11.20: Apply the appropriate patch for your system, as listed in Hewlett-Packard Security Bulletin HPSBUX0108-163. See References. References Internet Security Systems Security Alert #93 Remote Buffer Overflow Vulnerability in HP-UX Line Printer Daemon http://xforce.iss.net/alerts/advise93.php Hewlett-Packard Support Web site IT resource center http://us-support.external.hp.com Hewlett-Packard Security Bulletin HPSBUX0108-163 Sec. Vulnerability in rlpdaemon http://us-support.external.hp.com/cki/bin/doc.pl/sid=bdb76c6c0cce400353/ screen=ckiDisplayDocument?docId=200000056242915 CIAC Information Bulletin L-134 HP Security Vulnerability in rlpdaemon http://www.ciac.org/ciac/bulletins/l-134.shtml CERT Advisory CA-2001-30 Multiple Vulnerabilities in lpd http://www.cert.org/advisories/CA-2001-30.html CERT Vulnerability Note VU#966075 HP-UX vulnerable to buffer overflow in line printer daemon (rlpdaemon) via crafted print request http://www.kb.cert.org/vuls/id/966075 CIAC Information Bulletin M-014 UNIX - Multiple Vulnerabilities In LPD http://www.ciac.org/ciac/bulletins/m-014.shtml ISS X-Force HP-UX rlpd print protocol daemon buffer overflow http://xforce.iss.net/static/6811.php CVE CAN-2001-0668 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0668 227 Glimpse HTTP aglimpse allows remote command execution (HTTP_Glimpse) Alibaba Web server allows browsing the file system outside the server root directory (HTTP_DotDot) About this signature or vulnerability This vulnerability is detected by the HTTP_DotDot signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Alibaba Web Server Type Unauthorized Access Attempt Vulnerability description CSM Alibaba is a commercial HTTP server for Windows 95, Windows 98, and Windows NT. A vulnerability in the Alibaba HTTP server could allow a remote user to traverse directories on the Web server's file system outside the document root. A remote attacker can issue an HTTP GET request containing "dot dot" sequences (/../) to traverse directories and read any file on the Web server. If directory browsing is enabled, an attacker does not need prior knowledge of file names to exploit this vulnerability. How to remove this vulnerability CSM no longer exists and Alibaba has not been updated since 1996. Users are advised to upgrade to a newer Web server that has more updates and support. As a workaround, you should install the Alibaba server on a physical drive of its own, or disable the server if possible. References NTBugtraq Mailing List, Thu, 6 May 1999 23:51:27 +0200 ..-hole in Alibaba 2.0 http://www.ntbugtraq.com/ default.asp?pid=36&sid=1&A2=ind9905&L=ntbugtraq&F=P&S=&P=3407 ISS X-Force Alibaba Web server allows browsing the file system outside the server root directory http://xforce.iss.net/static/2175.php CVE CAN-1999-0776 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0776 Glimpse HTTP aglimpse allows remote command execution (HTTP_Glimpse) About this signature or vulnerability 228 This vulnerability is detected by the HTTP_Glimpse signature. Glimpse HTTP aglimpse allows remote command execution (HTTP_Glimpse) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Glimpse: 2.0, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The aglimpse program allows a remote attacker to execute arbitrary commands on a Web server. The aglimpse program is part of the Glimpse HTTP package, a Web interface to the glimpse search tool. Glimpse HTTP version 2.0 is vulnerable to this problem. The attacker can access the files on the Web server with the same user ID as that of the configuration of your Web server. This exploit could allow the attacker to gain root or administrator access to the host. In either case, it allows the attacker to alter the contents of your Web site. How to remove this vulnerability Upgrade to the latest version of WebGlimpse (1.5 or later), available from the WebGlimpse Web site. See References. As a workaround, log on as root on the vulnerable computer and type: # /bin/chmod 400 /usr/local/etc/httpd/cgi-bin/aglimpse Replace the path name with your cgi-bin directory. Patches: Insert a / character at the start of the open command in the aglimpse program (around line 72). The vulnerable line is: open(CONF,'$indexdir/archive.cfg') || &err_conf; The patched line is: open(CONF,'/$indexdir/archive.cfg') || &err_conf; References AUSCERT Advisory AA-97.28 Vulnerability in GlimpseHTTP and WebGlimpse cgi-bin Packages ftp://ftp.auscert.org.au/pub/auscert/advisory/AA97.28.GlimpseHTTP.WebGlimpse.vuls WebGlimpse Web site Unix-based search software http://glimpse.cs.arizona.edu/ CERT Vendor-Initiated Bulletin VB-97.13 Vulnerability in GlimpseHTTP and WebGlimpse CGI scripts http://www.cert.org/vendor_bulletins/VB-97.13.GlimpseHTTP.WebGlimpse Packetstorm Exploit Code Archive Glimpse http http://packetstorm.securify.com/Exploit_Code_Archive/glimpse_http.txt 229 IIS ASP source visible (HTTP_IIS3_Asp_Dot) CIAC Information Bulletin I-014 Vulnerability in GlimpseHTTP and WebGlimpse cgi-bin Packages http://www.ciac.org/ciac/bulletins/i-014.shtml ISS X-Force Glimpse HTTP aglimpse allows remote command execution http://xforce.iss.net/static/350.php CVE CVE-1999-0147 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0147 IIS 3.0 script source revealed by appending 2E to requests (HTTP_IIS3_Asp_Dot) About this signature or vulnerability This vulnerability is detected by the HTTP_IIS3_Asp_Dot signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Microsoft IIS: 3.0 and earlier Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) 3.0 required a hot-fix to patch a prior security vulnerability (the ASP Dot vulnerability). This hot-fix introduced a new security vulnerability that could allow an attacker to view the contents of an Active Server Page or other script by substituting a "." (period) in the URL with its hexadecimal value (2E). How to remove this vulnerability Upgrade to IIS 4.0, which fixes this vulnerability. References @stake, Inc./L0pht Security Advisory 03/19/97 Microsoft IIS 3.0 http://www.atstake.com/research/advisories/1997/asp.txt ISS X-Force IIS 3.0 script source revealed by appending 2E to requests http://xforce.iss.net/static/621.php IIS ASP source visible (HTTP_IIS3_Asp_Dot) About this signature or vulnerability 230 This vulnerability is detected by the HTTP_IIS3_Asp_Dot signature. IIS ASP source visible (HTTP_IIS3_Asp_Dot) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected SunOS, Windows NT Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) versions 2.0 and 3.0 display the source of Active Server Pages (ASP files), if a period is appended to the URL. In addition, scripting information to other data in the file can be viewed. Potentially proprietary Web server files (such as .ASP, .HTX, and .IDC file name extensions) may contain sensitive information (such as user IDs and passwords) embedded in the source code that is normally not available to remote users. How to remove this vulnerability Upgrade to the latest version of Microsoft Internet Information Server (version 5.0 or later), available from the Microsoft Windows Web Services (IIS) Web site. See References. — OR — If upgrading to the latest version is not possible, download the patch provided by Microsoft, as listed in Microsoft Knowledge Base Article Q163485. See References. As a workaround, disable read permissions for the ASP directory in the Internet Service Manager. This may not be a practical solution since many sites mix ASP and HTML files. If your site mixes these files together in the same directories, segregate them immediately. ASP files should be treated as any other Web-based executable and kept in separate directories where permissions can be adjusted. Windows NT Apply the latest Windows NT 4.0 Service Pack. References Microsoft Knowledge Base Article Q163485 Active Server Pages Script Appears in Browser http://support.microsoft.com/support/kb/articles/q163/4/85.asp Microsoft Knowledge Base Article Q164059 IIS Execution File Text Can Be Viewed in Client http://support.microsoft.com/support/kb/articles/q164/0/59.asp BugTraq Mailing List, Thu Feb 20 1997 12:51:04 Re: [NTSEC] ! [ADVISORY] Major Security Hole in MS ASP http://www.securityfocus.com/archive/1/6332 BugTraq Mailing List, Thu Feb 20 1997 09:39:01 ! [ADVISORY] Major Security Hole in MS ASP http://www.securityfocus.com/archive/1/6330 231 Sybase PowerDynamo PWS allows remote file system traversal (HTTP_DotDot) Microsoft Web site Microsoft Windows Web Services (IIS) Web site http://www.microsoft.com/technet/iis/ ISS X-Force IIS ASP source visible http://xforce.iss.net/static/7.php CVE CAN-1999-0154 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0154 Sybase PowerDynamo PWS allows remote file system traversal (HTTP_DotDot) About this signature or vulnerability This vulnerability is detected by the HTTP_DotDot signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Sybase, PowerDynamo PWS Type Unauthorized Access Attempt Vulnerability description PowerDynamo is a personal HTTP server developed by Sybase. PowerDynamo version 3.0.652 could allow a remote attacker to traverse directories on Web server's file system. A remote attacker can send a GET request containing "dot dot" sequences (/../) to traverse directories on the Web server's file system outside the document root and view any file on the Web server's file system. In order to exploit this vulnerability, the attacker does not need prior knowledge of file names if directory browsing is enabled. How to remove this vulnerability No remedy available as of April 2001. References BugTraq Mailing List, Sat Sep 04 1999 08:37:01 [Sybase] software vendors do not think about old bugs http://www.securityfocus.com/archive/1/26710 ISS X-Force Sybase PowerDynamo PWS allows remote file system traversal http://xforce.iss.net/static/3169.php CVE CVE-1999-0695 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0695 232 3Com AirConnect Easy Setup Web Access (HTTP_3com_AirConnect_EasySetup) TeamTrack HTTP server allows browsing the file system outside the server root directory (HTTP_DotDot) About this signature or vulnerability This vulnerability is detected by the HTTP_DotDot signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected TeamTrack Server: 3.00 Type Unauthorized Access Attempt Vulnerability description A security hole in the HTTP server supplied with TeamShare's TeamTrack problemtracking could allow a remote attacker to traverse directories on the Web server. A remote attacker could send a specially-crafted GET request containing "dot dot" sequences (/../) to traverse directories and read files outside the Web server's document root. How to remove this vulnerability TeamShare recommends users use a third party Web server like Microsoft's IIS or Netscape Enterprise Server. This issue has been resolved in TeamTrack 4.0, which is expected to be delivered in early 2000. References Rain Forest Puppy Security Advisory RFP9904 RFP9904: TeamTrack webserver vulnerability http://www.wiretrip.net/rfp/p/doc.asp?id=14&iface=3 BugTraq Mailing List, Sat Oct 02 1999 06:14:32 RFP9904: TeamTrack webserver vulnerability http://www.securityfocus.com/archive/1/29551 ISS X-Force TeamTrack HTTP server allows browsing the file system outside the server root directory http://xforce.iss.net/static/3281.php CVE CVE-1999-0933 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0933 3Com AirConnect Easy Setup Web Access (HTTP_3com_AirConnect_EasySetup) About this signature or vulnerability This signature detects an HTTP POST to "/_EasyInstall.htm," which indicates an attempt to use the 3Com AirConnect Easy Setup Web Interface. 233 3Com AirConnect Filtering Setup Web Access (HTTP_3com_AirConnect_FilteringSetup) False positives RealSecure Network Sensor: A false positive is possible for products other than 3Com AirConnect that use the URL "/_EasyInstall.htm." Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description An attempt to use the 3Com AirConnect Easy Setup Web interface has been detected. How to remove this vulnerability Disable the 3Com AirConnect Web Interface. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Easy Setup Web Access http://xforce.iss.net/static/6456.php 3Com AirConnect Filtering Setup Web Access (HTTP_3com_AirConnect_FilteringSetup) About this signature or vulnerability This signature detects an HTTP POST to "/_FilteringSetup.htm," which indicates an attempt to configure the Filtering setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. False positives RealSecure Network Sensor: A false positive is possible for products other than 3Com AirConnect that use the URL "/_FilteringSetup.htm." Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity 234 3Com AirConnect Firmware Web Access (HTTP_3com_AirConnect_FirmwareSetup) Vulnerability description An attempt is being made to configure the Filtering setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. How to remove this vulnerability Disable the 3Com AirConnect Web Interface. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Filtering Setup Web Access http://xforce.iss.net/static/6457.php 3Com AirConnect Firmware Web Access (HTTP_3com_AirConnect_FirmwareSetup) About this signature or vulnerability This signature detects an HTTP POST to "/_Firmware.htm," which indicates an attempt to configure the Firmware of a 3Com AirConnect 802.11 access point through the Web interface of the device. False positives RealSecure Network Sensor: A false positive is possible for products other than 3Com AirConnect that use the URL "/_Firmware.htm." Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description An attempt is being made to configure the Firmware of a 3Com AirConnect 802.11 access point through the Web interface of the device. How to remove this vulnerability Disable the 3Com AirConnect Web Interface. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Firmware Web Access http://xforce.iss.net/static/6458.php 235 3Com AirConnect RF Setup Web Access (HTTP_3com_AirConnect_RFSetup) 3Com AirConnect Modem Setup Web Access (HTTP_3com_AirConnect_ModemSetup) About this signature or vulnerability This signature detects an HTTP POST to "/_ModemSetup.htm," which indicates an attempt to configure the Modem setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. False positives RealSecure Network Sensor: A false positive is possible for products other than 3Com AirConnect that use the URL "/_ModemSetup.htm." Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description An attempt is being made to configure the Modem setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. How to remove this vulnerability Disable the 3Com AirConnect Web Interface. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Modem Setup Web Access http://xforce.iss.net/static/6459.php 3Com AirConnect RF Setup Web Access (HTTP_3com_AirConnect_RFSetup) About this signature or vulnerability This signature detects an HTTP POST to "/_RFSetup.htm," which indicates an attempt to configure the radio setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. False positives RealSecure Network Sensor: A false positive is possible for products other than 3Com AirConnect that use the URL "/_RFSetup.htm." Default risk level High 236 3Com AirConnect Security Setup Web Access (HTTP_3com_AirConnect_SecuritySetup) Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description An attempt is being made to configure the radio setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. How to remove this vulnerability Disable the 3Com AirConnect Web Interface. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect RF Setup Web Access http://xforce.iss.net/static/6460.php 3Com AirConnect Security Setup Web Access (HTTP_3com_AirConnect_SecuritySetup) About this signature or vulnerability This signature detects an HTTP POST to "/_SecuritySetup.htm," which indicates an attempt to configure the security setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. False positives RealSecure Network Sensor: A false positive is possible for products other than 3Com AirConnect that use the URL "/_SecuritySetup.htm." Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description An attempt is being made to configure the security setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. How to remove this vulnerability Disable the 3Com AirConnect Web Interface. 237 3Com AirConnect SNMP Setup Web Access (HTTP_3com_AirConnect_SNMPSetup) References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Security Setup Web Access http://xforce.iss.net/static/6461.php 3Com AirConnect SNMP Setup Web Access (HTTP_3com_AirConnect_SNMPSetup) About this signature or vulnerability This signature detects an HTTP POST to "/_SNMPSetup.htm," which indicates an attempt to configure the SNMP setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. False positives RealSecure Network Sensor: A false positive is possible for products other than 3Com AirConnect that use the URL "/_SNMPSetup.htm." Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description An attempt is being made to configure the SNMP setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. How to remove this vulnerability Disable the 3Com AirConnect Web Interface. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect SNMP Setup Web Access http://xforce.iss.net/static/6462.php 238 3Com AirConnect System Setup Web Access (HTTP_3com_AirConnect_SystemSetup) 3Com AirConnect Special Functions Web Access (HTTP_3com_AirConnect_SpecialFunctions) About this signature or vulnerability This signature detects an HTTP POST to "/_SpecialFunctions.htm," which indicates an attempt to configure the SNMP setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. False positives RealSecure Network Sensor: A false positive is possible for products other than 3Com AirConnect that use the URL "/_SpecialFunctions.htm." Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description An attempt is being made to configure the special functions of a 3Com AirConnect 802.11 access point through the Web interface of the device. How to remove this vulnerability Disable the 3Com AirConnect Web Interface. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect Special Functions Web Access http://xforce.iss.net/static/6463.php 3Com AirConnect System Setup Web Access (HTTP_3com_AirConnect_SystemSetup) About this signature or vulnerability This signature detects an HTTP POST to "/_SystemSetup.htm," which indicates an attempt to configure the system setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. False positives RealSecure Network Sensor: A false positive is possible for products other than 3Com AirConnect that use the URL "/_SystemSetup.htm." Default risk level High 239 ActiveX allows local command execution (HTTP_ActiveX) Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point Type Suspicious Activity Vulnerability description An attempt is being made to configure the system setup of a 3Com AirConnect 802.11 access point through the Web interface of the device. How to remove this vulnerability Disable the 3Com AirConnect Web Interface. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B ISS X-Force 3Com AirConnect System Setup Web Access http://xforce.iss.net/static/6464.php ActiveX allows local command execution (HTTP_ActiveX) About this signature or vulnerability Additional Vulnerabilities Found This signature detects when a web browser attempts to obtain a file containing a Microsoft ActiveX control. ■ ie-active-download False positives RealSecure Network Sensor: This signature does not determine if the ActiveX control being downloaded is malicious; it only detects that the browser is downloading ActiveX code. Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.5 Systems affected Windows Type Protocol Signature Vulnerability description ActiveX is a Web technology that can be used maliciously to execute local commands on the computer that is running ActiveX. For example, a remote attacker could use ActiveX to execute a local command to shut down the computer. 240 HTTP Anyform (HTTP_AnyForm) How to remove this vulnerability Review your organization's security policy on ActiveX. Consider disabling ActiveX for your Web browsers to reduce potential vulnerability to hostile ActiveX applets. References The NT Shop Web site Microsoft Active X Controls http://www.ntsecurity.net/security/ActiveX.htm ISS X-Force ActiveX allows local command execution http://xforce.iss.net/static/476.php HTTP Anyform (HTTP_AnyForm) About this signature or vulnerability This signature detects HTTP GET requests to the AnyForm2 CGI-bin program. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected AnyForm: 2.0 Type Unauthorized Access Attempt Vulnerability description AnyForm, by John Roberts, is a CGI-bin program used for simple forms that deliver email responses. A vulnerability in version 2 of AnyForm (AnyForm2) could allow a remote attacker to execute arbitrary commands on the Web server as the UID 'nobody'. How to remove this vulnerability No remedy available as of August 2001. AnyForm is no longer available and is restricted to use at the University of Kentucky. More information is available at the University of Kentucky Web site. See References. As a workaround, disable access or execute permission to the AnyForm2 script. References University of Kentucky Web site WEB FORMS WITH ANYFORM http://www.uky.edu/AnyForm BugTraq Mailing List, Mon Jul 31 1995 21:26:51 SECURITY HOLE: "AnyForm" CGI http://www.securityfocus.com/archive/1/3544 ISS X-Force HTTP Anyform http://xforce.iss.net/static/4907.php 241 AnyForm CGI script allows remote execution of arbitrary commands (HTTP_AnyFormPost) CVE CVE-1999-0066 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0066 AnyForm CGI script allows remote execution of arbitrary commands (HTTP_AnyFormPost) About this signature or vulnerability This signature detects specially-crafted HTTP POSTs to the AnyForm2 CGI-bin program. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description AnyForm, by John Roberts, is a CGI-bin program used for simple forms that deliver email responses. A vulnerability in version 2 of AnyForm (AnyForm2) could allow a remote attacker to execute malicious programs on a Web server. The program fails to properly perform sanity checks. A remote attacker could exploit this vulnerability by creating a form with a hidden field and sending the form to the program to execute malicious programs on the Web server. How to remove this vulnerability No remedy available as of August 2001. AnyForm is no longer available and is restricted to use at the University of Kentucky. More information is available at the University of Kentucky Web site. See References. As a workaround, disable access or execute permission to the AnyForm2 script. References University of Kentucky AnyForm Web site WEB FORMS WITH ANYFORM http://www.uky.edu/AnyForm BugTraq Mailing List, Mon Jul 31 1995 21:26:51 SECURITY HOLE: "AnyForm" CGI http://www.securityfocus.com/archive/1/3544 ISS X-Force AnyForm CGI script allows remote execution of arbitrary commands http://xforce.iss.net/static/301.php CVE CVE-1999-0066 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0066 242 Apache HTTP server beck exploit (HTTP_Apache_DOS) Apache HTTP server beck exploit (HTTP_Apache_DOS) About this signature or vulnerability False positives This signature detects an HTTP request containing a large number of slashes ("/"), which could indicate an attempt by an attacker to increase the load average on an Apache httpd server. RealSecure Network Sensor: A false positive is possible for valid URLs that contain more than 1000 slashes ("/"). RealSecure Server Sensor: A false positive is possible for valid URLs that contain more than 1000 slashes ("/"). Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 5.5 Systems affected Apache Web Server Type Denial of Service Vulnerability description Apache httpd servers prior to version 1.2.5 could allow an attacker to increase the load average on the server, possibly causing a denial of service. An attacker could submit an HTTP request containing thousands of slashes ("/") to cause the system running the server to become very slow or inaccessible. This problem has sometimes been referred to as the beck exploit. How to remove this vulnerability Upgrade to the latest version of Apache (1.2.5 or later), as listed in the Apache Security Advisory dated Tuesday, January 6 1998. See References. References Apache Server Project Web site Apache Security Advisory, Tuesday, January 6 1998 http://www.apache.org/info/security_bulletin_1.2.5.html BugTraq Mailing List, Tue Dec 30 1997 04:07:04 Apache DoS attack? http://www.securityfocus.com/archive/1/8310 CERT Vendor-Initiated Bulletin VB-98.02 Apache Security Advisory http://www.cert.org/vendor_bulletins/VB-98.02.apache ISS X-Force Apache HTTP server beck exploit http://xforce.iss.net/static/697.php 243 Axis StorPoint CD servers could allow remote access to admin pages (HTTP_Axis_Storpoint) HTTP authentication (HTTP_Authentication) About this signature or vulnerability This signature detects HTTP Basic authentication to a Web server and logs the usernames and passwords. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected HTTP Type Protocol Signature Vulnerability description Usernames and passwords used in HTTP Basic authentication to a Web server can be logged to determine which user accounts are logging into Web servers from particular systems. Collecting this information can be used to offload some logging tasks from heavily-loaded Web servers and help detect brute force password guessing attacks against the Web server. How to remove this vulnerability If a brute force password guessing attack is suspected, review the history of HTTP authentication events for more information. References ISS X-Force HTTP authentication http://xforce.iss.net/static/653.php Axis StorPoint CD servers could allow remote access to admin pages (HTTP_Axis_Storpoint) About this signature or vulnerability This signature detects an HTTP GET request for the cnf_gi.htm file. The request contains a "dot dot" (/../) sequence, which could indicate an attempt by an attacker to access the server's administration pages. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected StorPoint CD Server: 2.5.1 and earlier Type Unauthorized Access Attempt Vulnerability description Axis Communications network CD servers StorPoint CD and CD/T could allow a remote attacker to gain access to the server's administration pages, due to a vulnerability in the software's Web interface for remote administration. In versions of StorPoint CD and CD/ 244 Win32 CGI programs written as DOS batch files could allow remote command execution (HTTP_BAT_Execute) T previous to 4.28, an attacker can submit a specially-crafted URL to bypass authentication and access the server's administration pages. How to remove this vulnerability Upgrade to software version 4.28, available from the Axis Communications Web site. Axis recommends upgrading to hardware from one of their newer product lines. See References. References BugTraq Mailing List, Tue Feb 29 2000 06:18:54 Infosec.20000229.axisstorpointcd.a http://www.securityfocus.com/archive/1/48924 Axis Communications Web site Axis Communications Support Web http://www.axis.com/techsup/cdsrv/storpoint_cd/ ISS X-Force Axis StorPoint CD servers could allow remote access to admin pages http://xforce.iss.net/static/4078.php CVE CVE-2000-0191 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0191 Win32 CGI programs written as DOS batch files could allow remote command execution (HTTP_BAT_Execute) About this signature or vulnerability This signature detects an HTTP GET request for a batch file that appears to be an attempt to execute commands on the server. This event is never normal activity--it can only be an attempted attack on the server. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected Windows Type Unauthorized Access Attempt Vulnerability description Many Win32 Web servers have the ability to support multiple executable types as CGI (Common Gateway Interface) components. When MS-DOS batch files (.BAT) are used for this purpose and written in an insecure manner, they can allow remote attackers to execute arbitrary commands on the Web server. If the Web server passes the QUERY_STRING variable to the batch file with a '&' (ampersand) character embedded in it and the script performs no input validation, the commands after the ampersand are executed at the privilige level of the CGI program. How to remove this vulnerability Remove batch (.BAT) files from your Web server's CGI-BIN directory or rewrite them to properly validate user data. 245 Brown Orifice HTTPD (HTTP_BrownOrifice) References BugTraq Mailing List, Wed Feb 23 2000 15:52:10 Sambar Server alert! http://www.securityfocus.com/archive/1/48001 BugTraq Mailing List, Thu Feb 24 2000 13:00:44 Sambar Server alert! (2) http://www.securityfocus.com/archive/1/48181 ISS X-Force Win32 CGI programs written as DOS batch files could allow remote command execution http://xforce.iss.net/static/4425.php Brown Orifice HTTPD (HTTP_BrownOrifice) About this signature or vulnerability This signature detects an HTTP download containing a Java .class file using vulnerable Netscape Java classes that contain strings found in the BrownOrifice code. This may indicate that a malicious web site is attempting to exploit this vulnerability. False positives RealSecure Network Sensor: A false positive is possible if any .class file or any Java application being downloaded contains the specific strings found in the BrownOrifice code. False negatives RealSecure Network Sensor: A false negative is possible if an attacker modifies the source code of the BOHTTPD Java application to avoid detection by RealSecure. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3 Systems affected Netscape Communicator Type Unauthorized Access Attempt Vulnerability description The Netscape Java distribution could allow a hostile Web site to start a server process on the browsing system. Using "file:" URLs with the Netscape Java distribution, a remote attacker can access arbitrary files on the browser system and any locally connected networks, as demonstrated by the Brown Orifice program. Netscape Communicator versions 4.74 and earlier, and all versions of Netscape Navigator, are vulnerable when Java is enabled. How to remove this vulnerability Upgrade to the latest version of Netscape Communicator (4.75 or later), available from the Netscape Products Web site. See References. As a workaround, disable Java in the browser. To stop the server process on your computer after visiting a malicious Web site, close all open Netscape browser windows. 246 Brown Orifice HTTPD (HTTP_BrownOrifice) References CERT Advisory CA-2000-15 Netscape Allows Java Applets to Read Protected Resources http://www.cert.org/advisories/CA-2000-15.html Internet Security Systems Security Alert #58 Brown Orifice, BOHTTPD, a Platform Independent Java Vulnerability in Netscape http://xforce.iss.net/alerts/advise58.php Netscape Communications, Inc. Web site Netscape Security Notes http://www.netscape.com/security/notes/index.html Netscape Communications, Inc. Web site Netscape Products http://home.netscape.com/download/ BugTraq Mailing List, Sat Aug 05 2000 03:04:29 Dangerous Java/Netscape Security Hole http://www.securityfocus.com/archive/1/74163 Red Hat Linux Errata Advisory RHSA-2000:054-01 New Netscape packages fix Java security hole http://www.redhat.com/support/errata/RHSA-2000-054-01.html Caldera Systems, Inc. Security Advisory CSSA-2000-027.1 Netscape java security bug http://www.calderasystems.com/support/security/advisories/CSSA-2000-027.1.txt FreeBSD, Inc. Security Advisory FreeBSD-SA-00:39 Two Vulnerabilities in Netscape ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:39.netscape.asc SuSE Security Announcement #60 Security Hole in Netscape, Versions 4.x, possibly others http://www.suse.de/de/support/security/suse_security_announce_60.txt Linux-Mandrake Security Update Advisory MDKSA-2000:033 (from SecurityFocus Archive) Netscape Java vulnerability http://www.securityfocus.com/archive/1/75470 Linux-Mandrake Security Update Advisory MDKSA-2000:036 (from BugTraq Mailing List) netscape update http://www.securityfocus.com/archive/1/77454 BugTraq Mailing List, Fri Aug 18 2000 19:54:43 Conectiva Linux Security Announcement - netscape http://www.securityfocus.com/archive/1/77073 SecurityFocus.com news Beware 'Brown Orifice' http://www.securityfocus.com/news/70 CERT Vulnerability Note VU#32231 Netscape Java Security Manager fails to prevent URLConnections through 247 Squid cachemgr.cgi script can be used to remotely proxy portscans (HTTP_Cachemgr) netscape.net.URLConnection Class http://www.kb.cert.org/vuls/id/32231 National Infrastructure Protection Center (NIPC) Advisory 00-052 "Brown Orifice", August 9, 2000 http://www.nipc.gov/warnings/assessments/2000/00-052.htm CIAC Information Bulletin K-063 Netscape - Java Vulnerability http://www.ciac.org/ciac/bulletins/k-063.shtml ISS X-Force Brown Orifice HTTPD http://xforce.iss.net/static/5032.php CVE CVE-2000-0676 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0676 Squid cachemgr.cgi script can be used to remotely proxy portscans (HTTP_Cachemgr) About this signature or vulnerability This signature detects HTTP GET requests for cgi-bin/cachemgr.cgi. This CGI script is distributed with the Squid proxy. False positives RealSecure Network Sensor: RealSecure detects any use of the cachemgr.cgi, including legitimate use of the Squid cachemgr.cgi script (if it is installed in the cgi-bin directory). This script should be in a protected CGI directory to secure it. This signature can be used to detect an attacker trying to use the script from the cgi-bin directory (its default location in Red Hat Linux and possibly other Linux distributions). RealSecure Server Sensor: Legitimate use of the Squid cachemgr.cgi. Seems bad, but this script should be in a protected CGI directory to secure it. This will detect people trying to use it in its default location in Redhat (et al, if any). Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI), Squid, Red Hat Linux: 6.0 Type Unauthorized Access Attempt Vulnerability description The cachemgr.cgi script is distributed with the Squid proxy as a tool for managing and viewing statistics about a running cache server. The cachemgr.cgi script is not installed by default into a system's Web server CGI directory. However, under some systems (including Red Hat Linux), the cachemgr.cgi script can be found in this directory with no access controls in place. This script can be used by a remote attacker to connect to 248 Campas cgi-bin file executes remote commands (HTTP_Campas) arbitrary hosts and ports which could be used to "proxy" portscans through vulnerable systems. How to remove this vulnerability Remove the cachemgr.cgi script from your server's CGI-BIN directory. References BugTraq Mailing List, Fri Jul 23 1999 16:36:32 Redhat 6.0 cachemgr.cgi lameness http://www.securityfocus.com/archive/1/19392 Red Hat Linux Errata Advisory RHSA-1999:025-01 Potential misuse of squid cachemgr.cgi http://www.redhat.com/support/errata/RHSA1999025_01.html ISS X-Force Squid cachemgr.cgi script can be used to remotely proxy portscans http://xforce.iss.net/static/2385.php CVE CVE-1999-0710 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0710 Campas cgi-bin file executes remote commands (HTTP_Campas) About this signature or vulnerability This signature detects an attack against the campas cgi-bin script present with certain httpd Web servers. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected NCSA Servers: Old Versions, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The campas CGI program allows a remote attacker to execute commands on a Web server with the privileges of the user owning the server process. The campas program is included as a sample CGI program in some older versions of the NCSA Web server. Depending on the configuration of the Web server, this could allow an attacker to gain root or administrator access to the host. This vulnerability also allows an attacker to alter the contents of the Web site. How to remove this vulnerability Delete the campas cgi-bin script. — AND — Upgrade your HTTP server to the latest available version. 249 iCat Carbo Server allows remote file viewing (HTTP_Carbo_Server) References BugTraq Mailing List, Tue Jul 15 1997 16:24:31 Bug CGI campas http://www.securityfocus.com/archive/1/7252 ISS X-Force Campas cgi-bin file executes remote commands http://xforce.iss.net/static/298.php CVE CVE-1999-0146 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0146 iCat Carbo Server allows remote file viewing (HTTP_Carbo_Server) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected iCat Carbo Server Type Unauthorized Access Attempt Vulnerability description iCat Carbo Server is a program used for creating interactive online catalogs. A vulnerability in iCat could allow a remote user to view any file on the system that iCat is running on. This vulnerability has been confirmed in Carbo Server version 3.0.0. How to remove this vulnerability If possible, disable the Carbo server until a patch or upgrade becomes available from iCat. In disabling the Carbo server, ensure that the carbo.dll file is deleted. References BugTraq Mailing List, Sat Nov 08 1997 11:11:12 Security bug in iCat Suite version 3.0 http://www.securityfocus.com/archive/1/7943 iCat.Com Web site iCat.Com: e-commerce solutions http://www.icat.com/ ISS X-Force iCat Carbo Server allows remote file viewing http://xforce.iss.net/static/1620.php CVE CAN-1999-1069 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1069 250 Carello Web shopping cart add.exe allows remote file creation and duplication (HTTP_Carello) Carello Web shopping cart add.exe allows remote file creation and duplication (HTTP_Carello) About this signature or vulnerability This signature detects specially formatted HTTP GET requests that include QUOT;add.exe", which could allow an attacker to create copies of files on the server. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected Carello: 1.2.1 Type Unauthorized Access Attempt Vulnerability description Carello Web version 1.2.1 may reveal the source code of files on the server. Carello Web is a Web site shopping cart application developed by Pacific Software. An attacker could use the "add.exe" component in Carello Web to create copies of known files on the Web server, using a different file extension for the new file. An attacker could then submit an HTTP request for the new file to view its source. If the copied file is a server-side ASP file (Active Server Page), the source could reveal sensitive information, such as usernames and passwords. How to remove this vulnerability No remedy available as of March 2001. As a workaround, disable access by anonymous Internet accounts to directories that contain sensitive information. References @stake, Inc./Cerberus Information Security Advisory CISADV000524b Carello Web file overwriting vulnerability http://www.atstake.com/research/advisories/2000/advcarello.html Pacific Software Publishing Carello Web http://www.carelloweb.com/ ISS X-Force Carello Web shopping cart add.exe allows remote file creation and duplication http://xforce.iss.net/static/4542.php CVE CVE-2000-0396 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0396 251 Cart32 shopping cart allows remote attackers to change admin password (HTTP_Cart32_ChangeAdminPassword) Cart32 shopping cart allows remote attackers to change admin password (HTTP_Cart32_ChangeAdminPassword) About this signature or vulnerability This signature detects an access attempt to the c32web.exe CGI program. The access attempt includes a 'ChangeAdminPassword' parameter. False positives RealSecure Network Sensor: This signature does not distinguish between authorized and unauthorized attempts to change a Cart32 administrator password. RealSecure Server Sensor: This signature does not distinguish between authorized and unauthorized attempts to change a Cart32 administrator password. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2, RealSecure Server Sensor: 6.5 Systems affected Cart32: 2.6, Cart32: 3.0 Type Unauthorized Access Attempt Vulnerability description Cart32 is an online shopping cart system developed by McMurtrey/Whitaker & Associates for the Windows platform. A vulnerability in the c32web.exe CGI component of Cart32 could allow a remote attacker to change the administrator password to an arbitrary value without knowledge of the original password. By exploiting this vulnerability, a remote attacker can gain access to the Cart32 Administration program. How to remove this vulnerability Apply the patch from the McMurtrey/Whitaker & Associates Web site, as listed in Cart32 Knowledge Base Article: c048. See References. References BugTraq Mailing List, Thu Apr 27 2000 21:30:37 Re: Alert: Cart32 secret password backdoor (CISADV000427) http://www.securityfocus.com/archive/1/57566 Cart32 Knowledge Base Article c048 McMurtrey/Whitaker & Associates, Inc. responds to "backdoor password" reports. http://www.cart32.com/kbshow.asp?article=c048 @stake, Inc./Cerberus Information Security Advisory CISADV000427 Cart32 secret password Backdoor http://www.atstake.com/research/advisories/2000/advcart32.html ISS X-Force Cart32 shopping cart allows remote attackers to change admin password http://xforce.iss.net/static/4351.php CVE CAN-2000-0429 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0429 252 Cart32 shopping cart allows remote access to client lists and admin functions (HTTP_Cart32_ClientList) Cart32 shopping cart allows remote access to client lists and admin functions (HTTP_Cart32_ClientList) About this signature or vulnerability This signature detects an access attempt to the cart32.exe CGI program. This access attempt includes a 'cart32clientlist' parameter. False positives RealSecure Network Sensor: This signature does not distinguish between authorized and unauthorized requests to the cart32.exe CGI program for the Cart32 client list. RealSecure Server Sensor: This signature does not distinguish between authorized and unauthorized requests to the cart32.exe CGI program for the Cart32 client list. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2, RealSecure Server Sensor: 6.5 Systems affected Cart32: 2.6, Cart32: 3.0 Type Unauthorized Access Attempt Vulnerability description Cart32 is an online shopping cart system developed by McMurtrey/Whitaker & Associates for the Windows platform. Cart32 could allow a remote attacker to gain unauthorized access to a list of shopping cart clients, due to a vulnerability in the cart32.exe CGI component. An attacker could exploit this vulnerability to obtain sensitive information, including passwords and customer information, such as credit card numbers. How to remove this vulnerability Apply the patch from the McMurtrey/Whitaker & Associates Web site, as listed in Cart32 Knowledge Base Article: c048. See References. References BugTraq Mailing List, Thu Apr 27 2000 21:30:37 Re: Alert: Cart32 secret password backdoor (CISADV000427) http://www.securityfocus.com/archive/1/57566 Cart32 Knowledge Base Article c048 McMurtrey/Whitaker & Associates, Inc. responds to "backdoor password" reports. http://www.cart32.com/kbshow.asp?article=c048 @stake, Inc./Cerberus Information Security Advisory CISADV000427 Cart32 secret password Backdoor http://www.atstake.com/research/advisories/2000/advcart32.html ISS X-Force Cart32 shopping cart allows remote access to client lists and admin functions http://xforce.iss.net/static/4350.php 253 Cdomain whois_raw.cgi script allows remote execution of arbitrary commands (HTTP_Cdomain) Cart32 shopping cart allows remote access to server installation details (HTTP_Cart32_Expdate) About this signature or vulnerability This signature detects an access attempt to the "cart32.exe" CGI program with an argument of "expdate", which could indicate an attempt by an attacker to retrieve sensitive information about the server installation. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected Cart32: 2.6, Cart32: 3.0 Type Suspicious Activity Vulnerability description Cart32 is an online shopping cart system developed by McMurtrey/Whitaker & Associates. A vulnerability in the cart32.exe CGI executable could allow a remote attacker to retrieve sensitive information about the server installation, including environment settings and a list of programs in the CGI-BIN directory. A remote attacker can exploit this vulnerability by appending the string "/expdate" to a request for the cart32.exe CGI. How to remove this vulnerability No remedy available as of February 2001. References BugTraq Mailing List, Tue May 02 2000 08:39:26 Another interesting Cart32 command http://www.securityfocus.com/archive/1/58160 ISS X-Force Cart32 shopping cart allows remote access to server installation details http://xforce.iss.net/static/4398.php CVE CVE-2000-0430 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0430 Cdomain whois_raw.cgi script allows remote execution of arbitrary commands (HTTP_Cdomain) About this signature or vulnerability This signature detects a type of HTTP request to a whois_raw.cgi script. This type of request indicates that an attacker is attempting to execute programs to gain unauthorized access on your Web server running Cdomain 1.x. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 254 Cisco Aironet Web Configuration in use (HTTP_Cisco_Aironet_Webconfig) Systems affected Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description Cdomain is a commercial CGI package that provides a Web-based gateway to the Whois service. A vulnerability in the script of Freeware versions of Cdomain previous to 2.5 could allow a remote attacker to use shell metacharacters (such as &, |, or \) in the domain entry to execute arbitrary commands on the system with privileges of the Web server process. Later versions of CdomainFree, as well as all versions of CdomainPro are not vulnerable, because they connect directly to the Whois server. However, this vulnerability affects the whois_raw.cgi in versions 1.x and the cdomain.pl in versions 2.0 through 2.4. How to remove this vulnerability Upgrade to the latest version of CdomainFree (2.5 or later), available from the Cdomain Web site. See References. References BugTraq Mailing List, Tue Jun 01 1999 01:34:51 whois_raw.cgi problem http://www.securityfocus.com/archive/1/14019 Cdomain Web site Cdomain Home http://www.cdomain.com/ ISS X-Force Cdomain whois_raw.cgi script allows remote execution of arbitrary commands http://xforce.iss.net/static/2251.php Cisco Aironet Web Configuration in use (HTTP_Cisco_Aironet_Webconfig) About this signature or vulnerability This signature detects an HTTP POST to "/cgi-bin/cgiSetupNav," which indicates an attempt to configure a Cisco AiroNet 802.11 Access Point through the Web interface of the device. False positives RealSecure Network Sensor: A false positive is possible for products other than Cisco Aironet that use the URL "/cgi-bin/cgiSetupNav." Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected Cisco Aironet Access Point Type Suspicious Activity 255 Cisco Catalyst allows anonymous user to execute commands (HTTP_Cisco_Catalyst_Exec) Vulnerability description An attempt is being made to configure a Cisco AiroNet 802.11 Access Point through the Web interface of the device. How to remove this vulnerability Disable Web access to the AiroNet device. References Cisco Technology Solutions Wireless Solutions http://www.cisco.com/warp/public/779/smbiz/netsolutions/find/wireless.shtml ISS X-Force Cisco Aironet Web Configuration in use http://xforce.iss.net/static/6465.php Cisco Catalyst allows anonymous user to execute commands (HTTP_Cisco_Catalyst_Exec) About this signature or vulnerability In order to reduce false positives, this signature can be configured in RealSecure to ignore particular HTTP GET requests that begin with "/exec/." For example, you may wish to ignore all HTTP GET requests that begin with "/exec/java," since such a request is less likely to indicate the actions of an attacker. Use the "Ignore" option in the policy entry for this signature to configure which, if any, "/exec/" HTTP GET requests should be ignored by RealSecure. False positives RealSecure Network Sensor: A false positive is possible if a directory named "/exec/" exists on the root of the Web server and is accessed by a browser. However, false positives can be reduced by using the "Ignore" option in the policy entry for this signature to configure which, if any, "/exec/" HTTP GET requests should be ignored by RealSecure. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected Cisco Catalyst: 3500 XL Type Unauthorized Access Attempt Vulnerability description A vulnerability in the Web-based configuration interface of Cisco Catalyst 3500 XL series switches could allow a remote attacker to execute arbitrary commands. By requesting the /exec directory, a remote attacker can bypass authentication and execute arbitrary commands on the device. An attacker can use this vulnerability to view the configuration file and obtain user passwords. How to remove this vulnerability No remedy available as of February 2001. As a workaround, disable the Web configuration interface. 256 Cisco IOS routers denial of service caused by HTTP commands (HTTP_Cisco_IOS_DoS) References BugTraq Mailing List, Thu Oct 26 2000 10:51:55 Advisory def-2000-02: Cisco Catalyst remote command execution http://www.securityfocus.com/archive/1/141471 BugTraq Mailing List, Mon Nov 13 2000 19:35:08 Re: 3500XL http://www.securityfocus.com/archive/1/144655 ISS X-Force Cisco Catalyst allows anonymous user to execute commands http://xforce.iss.net/static/5415.php CVE CVE-2000-0945 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0945 Cisco IOS routers denial of service caused by HTTP commands (HTTP_Cisco_IOS_DoS) About this signature or vulnerability This signature detects an HTTP GET request containing the string "/%%". A specially formatted HTTP GET request containing this string can crash some versions of the IOS HTTP server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected Cisco IOS Type Denial of Service Vulnerability description The Cisco IOS operating system found on many Cisco routers is vulnerable to a denial of service attack if the HTTP server is enabled. By sending a specially-crafted URL to the router (in the form of http://<router_ip>/%%), a remote attacker can crash the router. This attack will cause the router to restart and could also require that the router be manually powered down and restarted. How to remove this vulnerability Install the appropriate patch or disable the HTTP server on the router, as listed in Cisco Systems Field Notice, May 14, 2000. See References. References BugTraq Mailing List, Wed Apr 26 2000 05:24:07 Cisco HTTP possible bug http://www.securityfocus.com/archive/1/57363 Cisco Systems Field Notice, May 14, 2000 Cisco IOS HTTP Server Vulnerability http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml 257 Cisco IOS query denial of service (HTTP_Cisco_IOS_Query_DoS) CERT Vulnerability Note VU#24346 Cisco IOS software vulnerable to DoS via HTTP request containing "%%" http://www.kb.cert.org/vuls/id/24346 ISS X-Force Cisco IOS routers denial of service caused by HTTP commands http://xforce.iss.net/static/4357.php CVE CVE-2000-0380 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0380 Cisco IOS query denial of service (HTTP_Cisco_IOS_Query_DoS) About this signature or vulnerability This signature detects an HTTP request for "/cgi-bin/view-source?/", which could indicate an attempt by an attacker to crash the Cisco router. Default risk level Low Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected Cisco IOS Type Denial of Service Vulnerability description Cisco IOS versions 12.0 through 12.1 are vulnerable to a denial of service attack when the HTTP service is enabled. By requesting a URL containing any text followed by "?/" and supplying the enable password, a remote attacker can cause a Cisco router or switch to enter an infinite loop. After two minutes, the router crashes and automatically restarts. If the router fails to properly restart, the device must be manually restarted to regain functionality. How to remove this vulnerability Upgrade to the latest version of Cisco IOS appropriate for your system, as listed in Cisco Systems Field Notice, October 25, 2000. See References. References Cisco Systems Field Notice, October 25, 2000 Cisco IOS HTTP Server Query Vulnerability http://www.cisco.com/warp/public/707/ioshttpserverquery-pub.shtml CORE SDI S.A. Security Advisory CORE-20002510 Vulnerability Report For Cisco IOS Web Administration DoS http://www.core-sdi.com/advisories/cisco_ios_web_adm.htm CERT Vulnerability Note VU#683677 Cisco IOS software vulnerable to DoS via HTTP request containing "?/" http://www.kb.cert.org/vuls/id/683677 258 Classifieds.cgi script allows a remote attacker to read arbitrary files off servers (HTTP_Classifieds_Post) CIAC Information Bulletin L-012 Cisco IOS HTTP Server Query Vulnerability http://www.ciac.org/ciac/bulletins/l-012.shtml ISS X-Force Cisco IOS query denial of service http://xforce.iss.net/static/5412.php CVE CAN-2000-0984 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0984 Classifieds.cgi script allows a remote attacker to read arbitrary files off servers (HTTP_Classifieds_Post) About this signature or vulnerability This signature detects HTTP POSTs to 'cgi-bin/classifieds.cgi.' Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description Classifieds is a free CGI script for handling classified ads on Web pages. A vulnerability in the classifieds.cgi script allows a remote attacker to specify an email address that will mail arbitrary files off the system to the attacker's address. This could allow an attacker to steal files from the target system. How to remove this vulnerability Disable the classifieds.cgi script in your CGI-BIN directory until a patch or upgrade becomes available or a version that corrects this issue is released. References The Most Comprehensive List of CGI & httpd Bugs Classifieds (classifieds.cgi) http://secinf.net/info/www/cgi-bugs.htm notts.net Web site Classifieds.cgi - by Greg Mathews http://www.cgi.notts.net/rs/gmathews/classifieds.html ISS X-Force Classifieds.cgi script allows a remote attacker to read arbitrary files off servers http://xforce.iss.net/static/3102.php 259 ColdFusion Expression Evaluator allows remote file manipulation (HTTP_Cold_Fusion) CVE CVE-1999-0934 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0934 ColdFusion Expression Evaluator allows remote file manipulation (HTTP_Cold_Fusion) Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected ColdFusion Type Unauthorized Access Attempt Vulnerability description Many versions of ColdFusion ship with many sample scripts and programs used for demonstration purposes. The Expression Evaluator (shipped with ColdFusion 4.0 and earlier) is one such sample program and is used to demonstrate the expression evaluation features of ColdFusion. A vulnerability in the Expression Evaluator could allow a remote attacker to view, delete, or upload (create) arbitrary files on the server. Normally, the Expression Evaluator program is accessible only from the localhost computer (127.0.0.1), but when accessed directly it allows connections from any host. How to remove this vulnerability Apply the Cold Fusion 4.0.1 Update, as listed in Allaire Security Bulletin ASB99-01. See References. — OR — Apply the appropriate ColdFusion Expression Evaluator Security Patch for your system, as listed in Allaire Security Bulletin ASB99-01. See References. — OR — If you do not wish to apply the 4.0.1 Update or the Cold Fusion Evaluator Security Patch, remove the Cold Fusion Expression Evaluator (evaluate.cfm) from //CFDOCS/expeval. — AND — Allaire recommends removing all sample code, example applications, tutorials and documentation from production servers. As a rule, sample code and example applications should not be installed on production servers. References Allaire Security Bulletin ASB99-01 Expression Evaluator Security Issues http://www.allaire.com/handlers/index.cfm?ID=8727 @stake, Inc./L0pht Security Advisory 04/20/99 Cold Fusion Application Server http://www.atstake.com/research/advisories/1999/cfusion.txt 260 ColdFusion Web administration feature can be used to stop the CF server (HTTP_ColdFusion_Admin) Phrack Magazine, Volume 8, Issue 54, File 08 of 12 NT Web Technology Vulnerabilities http://packetstorm.securify.com/mag/phrack/phrack54/P54-08 Allaire Corporation Web site ColdFusion 4.0.1 Update http://www.allaire.com/handlers/index.cfm?ID=10712 ISS X-Force ColdFusion Expression Evaluator allows remote file manipulation http://xforce.iss.net/static/1740.php ColdFusion Web administration feature can be used to stop the CF server (HTTP_ColdFusion_Admin) About this signature or vulnerability This signature detects HTTP GET requests for the ColdFusion Administrator startstop.html file located in the cfide/administrator directory. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows NT, ColdFusion: 4.x Type Denial of Service Vulnerability description The ColdFusion Administrator includes a utility for starting and stopping the ColdFusion service from a Web browser. Due to a problem that exists in this feature when Advanced Security is enabled, any remote user could stop the ColdFusion server. How to remove this vulnerability This issue was resolved in ColdFusion version 4.5.2. Download and install version 4.5.2 from Allaire's ColdFusion download page. See references. As a temporary solution, remove the startstop.html page from the CFIDE/Administrator directory under the server's document root. If this functionality is required, traditional Web server access controls can be placed on this file to restrict access to authorized users. References Allaire Security Bulletin ASB99-07 Solution Available for Denial-of-Service Attack Using CF Admin. Start/Stop Utility http://www.allaire.com/handlers/index.cfm?ID=10968 Allaire Corporation Web site ColdFusion Downloads page http://www.allaire.com/products/coldfusion/index.cfm ISS X-Force ColdFusion Web administration feature can be used to stop the CF server http://xforce.iss.net/static/2207.php 261 ColdFusion CFCACHE tag could expose temporary files with sensitive information (HTTP_ColdFusion_Cfcache) CVE CVE-1999-0756 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0756 ColdFusion CFCACHE tag could expose temporary files with sensitive information (HTTP_ColdFusion_Cfcache) About this signature or vulnerability This signature detects an HTTP GET request for the cfcache.map file, which could indicate an attacker's attempt to retrieve temporary files containing potentially sensitive information. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: SR 1.1, RealSecure Server Sensor: 6.5 Systems affected ColdFusion: 4.0, ColdFusion: 4.0.1 Type Unauthorized Access Attempt Vulnerability description ColdFusion 4.x uses a CFCACHE tag, which aids rapid page delivery by intelligently compiling CFM pages and caching them. A vulnerability in this feature could a allow remote attacker to retrieve temporary files containing potentially sensitive information. How to remove this vulnerability Upgrade to ColdFusion version 4.5. — OR — For ColdFusion 4.0x, apply the CFCACHE.CFM patch, as listed in Allaire Security Bulletin ASB00-03. See References. References Allaire Security Bulletin ASB00-03 Patch Available For Potential Information Exposure By The CFCACHE Tag http://www.allaire.com/handlers/index.cfm?ID=13978 ISS X-Force ColdFusion CFCACHE tag could expose temporary files with sensitive information http://xforce.iss.net/static/3862.php CVE CVE-2000-0057 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0057 262 ColdFusion email example script can be used to view arbitrary files (HTTP_ColdFusion_Email_ExampleApp) ColdFusion email example script can be used to view arbitrary files (HTTP_ColdFusion_Email_ExampleApp) About this signature or vulnerability This signature detects an HTTP GET request for "CFDOCS/exampleapps/email/ login.cfm". This could indicate an attacker's attempt to bypass access restrictions in order to view files on the Web server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 3.2 Systems affected ColdFusion: 4.5 Type Unauthorized Access Attempt Vulnerability description Macromedia ColdFusion version 4.5 ships with several sample programs and scripts used for demonstration purposes. These programs and scripts are accessible only through the local host. A vulnerability in the email example script could allow a remote attacker to bypass access restrictions and view arbitrary files on the server. The attacker could bypass access restrictions by sending an HTTP request with a spoofed Host variable in the HTTP header. Once a successful login has occurred, the attacker can send a specially-crafted URL to view any file on the Web server. How to remove this vulnerability Macromedia does not intend to release a patch for this vulnerability. As a workaround, do not install example applications or documentation on production ColdFusion servers. Example applications are stored in the /CFDOCS/exampleapps directory. As a rule, sample code and example applications should not be installed on production servers. — OR — Upgrade to the latest version of Macromedia ColdFusion (5.0 or later), available from the Macromedia Web site. See References. References Internet Security Systems Security Alert #92 Remote Vulnerabilities in Macromedia ColdFusion Example Applications http://xforce.iss.net/alerts/advise92.php Macromedia Security Bulletin (MPSB01-08) Best practice recommended to address new security issue in example applications released with ColdFusion Server versions 4.x and earlier. http://www.allaire.com/Handlers/index.cfm?ID=21700 Macromedia Web site Macromedia ColdFusion http://www.macromedia.com/software/coldfusion/downloads/ 263 ColdFusion sample program can be used to confirm existence of arbitrary files (HTTP_ColdFusion_FileExists) ISS X-Force ColdFusion email example script can be used to view arbitrary files http://xforce.iss.net/static/6791.php CVE CAN-2001-0535 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0535 ColdFusion sample program can be used to confirm existence of arbitrary files (HTTP_ColdFusion_FileExists) About this signature or vulnerability This signature detects HTTP GET requests for the Allaire server's fileexists.cfm page or Allaire code samples on the server. Default risk level Low Sensors that have this signature RealSecure Network Sensor: XPU 2.3 Systems affected ColdFusion Type Suspicious Activity Vulnerability description ColdFusion Server 4.0 ships with several sample applications. A remote attacker could access one of these sample programs, fileexists.cfm, to remotely confirm the existence of arbitrary files on the server. This information could be useful to an attacker in performing additional attacks. How to remove this vulnerability Apply the Cold Fusion 4.0.1 Update, as listed in Allaire Security Bulletin ASB99-02. See References. — AND — Remove the fileexists.cfm program and all sample applications and code from from all production servers. References Allaire Security Bulletin ASB99-02 ColdFusion 4.0 Example Applications and Sample Code Exposes Servers http://www.allaire.com/handlers/index.cfm?ID=8739 Allaire Corporation Web site ColdFusion 4.0.1 Update http://www.allaire.com/handlers/index.cfm?ID=10712 ISS X-Force ColdFusion sample program can be used to confirm existence of arbitrary files http://xforce.iss.net/static/1743.php 264 ColdFusion sample program can allow remote users to read any file (HTTP_ColdFusion_SourceWindow) CVE CAN-1999-0923 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0923 ColdFusion sample program can allow remote users to read any file (HTTP_ColdFusion_SourceWindow) About this signature or vulnerability This signature detects HTTP GET requests for the "sourcewindow.cfm" sample file, which could indicate an attempt by an attacker to read arbitrary files from the Web server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected ColdFusion Type Unauthorized Access Attempt Vulnerability description The ColdFusion sample program sourcewindow.cfm contains a vulnerability that could allow remote attackers to read any file on the system. How to remove this vulnerability Install the Cold Fusion 4.0.1 Update, available from the Allaire Web site. See References. It is recommended that the sourcewindow.cfm program be removed from all production servers. References Allaire Security Bulletin ASB99-02 ColdFusion 4.0 Example Applications and Sample Code Exposes Servers http://www.allaire.com/handlers/index.cfm?ID=8739 Allaire Corporation Web site ColdFusion 4.0.1 Update http://www.allaire.com/handlers/index.cfm?ID=10712 ISS X-Force ColdFusion sample program can allow remote users to read any file http://xforce.iss.net/static/1744.php CVE CAN-1999-0923 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0923 265 ColdFusion sample can reveal source to any CFM file (HTTP_ColdFusion_ViewExample) ColdFusion syntax checker could consume all processor resources (HTTP_ColdFusion_SyntaxChecker_DOS) About this signature or vulnerability This signature detects HTTP GET requests for the "cfmlsyntaxchecker.cfm" sample file, which could indicate an attempt by an attacker to cause a denial of service attack on the Web server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected ColdFusion Type Denial of Service Vulnerability description The Syntax Checker is a program shipped with ColdFusion. Its purpose is to test CFML (ColdFusion Markup Language) code for compatibility with ColdFusion version 4.0. A vulnerability in the Syntax Checker program could allow a remote attacker to cause the system to consume all available processor resources. How to remove this vulnerability Install the Cold Fusion 4.0.1 Update from the Allaire Web site. See References. It is recommended that users remove the cfmlsyntaxcheck.cfm program from all production servers. References Allaire Security Bulletin ASB99-02 ColdFusion 4.0 Example Applications and Sample Code Exposes Servers http://www.allaire.com/handlers/index.cfm?ID=8739 Allaire Corporation Web site ColdFusion 4.0.1 Update http://www.allaire.com/handlers/index.cfm?ID=10712 ISS X-Force ColdFusion syntax checker could consume all processor resources http://xforce.iss.net/static/1742.php CVE CAN-1999-0923 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0923 ColdFusion sample can reveal source to any CFM file (HTTP_ColdFusion_ViewExample) About this signature or vulnerability 266 This signature detects HTTP GET requests for the "viewexample.cfm" sample page, which could indicate an attempt by an attacker to retrieve CFM source code from the server. ColdFusion Web publish example script can be used to upload and execute files (HTTP_ColdFusion_WebPublish_ExampleApp) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected ColdFusion Type Unauthorized Access Attempt Vulnerability description ColdFusion 4.0 ships with many sample applications and scripts that are installed by default. A vulnerability in the viewexample.cfm program could allow a remote user to view the source of any CFM file on the server. This could allow an attacker to gain proprietary information, such as usernames and passwords, contained in the source code. How to remove this vulnerability Install the Cold Fusion 4.0.1 Update from the Allaire Web site. See References. — AND — Remove all samples, including viewexample.cfm, from production Web servers, as recommended in Allaire Security Bulletin (ASB99-02). See References. References Allaire Security Bulletin ASB99-02 ColdFusion 4.0 Example Applications and Sample Code Exposes Servers http://www.allaire.com/handlers/index.cfm?ID=8739 Allaire Corporation Web site ColdFusion 4.0.1 Update http://www.allaire.com/handlers/index.cfm?ID=10712 ISS X-Force ColdFusion sample can reveal source to any CFM file http://xforce.iss.net/static/1741.php CVE CAN-1999-0923 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0923 ColdFusion Web publish example script can be used to upload and execute files (HTTP_ColdFusion_WebPublish_ExampleApp) About this signature or vulnerability This signature detects an HTTP GET request for "cfdocs/exampleapps/publish/admin/ index.cfm". This could indicate an attacker's attempt to bypass access restrictions in order to upload malicious files to the Web server. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.2 267 Cookies passed to Web browser (HTTP_Cookie) Systems affected ColdFusion: 4.5 Type Suspicious Activity Vulnerability description Macromedia ColdFusion version 4.5 ships with several sample applications and scripts used for demonstration purposes. These programs and scripts are accessible only through the local host. A vulnerability in the Web publish example script could allow a remote attacker to bypass access restrictions and upload files to the Web server. The attacker could bypass access restrictions by sending an HTTP request with a spoofed Host variable in the HTTP header. An attacker could use this vulnerability to upload and execute malicious files on an affected Web server. How to remove this vulnerability Macromedia does not intend to release a patch for this vulnerability. As a workaround, do not install example applications or documentation on production ColdFusion servers. Example applications are stored in the /CFDOCS/exampleapps directory. As a rule, sample code and example applications should not be installed on production servers. — OR — Upgrade to the latest version of Macromedia ColdFusion (5.0 or later), available from the Macromedia Web site. See References. References Internet Security Systems Security Alert #92 Remote Vulnerabilities in Macromedia ColdFusion Example Applications http://xforce.iss.net/alerts/advise92.php Macromedia Security Bulletin (MPSB01-08) Best practice recommended to address new security issue in example applications released with ColdFusion Server versions 4.x and earlier. http://www.allaire.com/Handlers/index.cfm?ID=21700 Macromedia Web site Macromedia ColdFusion http://www.macromedia.com/software/coldfusion/downloads/ ISS X-Force ColdFusion Web publish example script can be used to upload and execute files http://xforce.iss.net/static/6790.php CVE CAN-2001-0535 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0535 Cookies passed to Web browser (HTTP_Cookie) About this signature or vulnerability 268 This signature detects a Web client passing a cookie to a server, indicating the Web client has already accepted a cookie and is passing it back to the server. Count.cgi allows remote users to view arbitrary GIF files (HTTP_Count) Default risk level Low Sensors that have this signature RealSecure Network Sensor: 2.0, RealSecure Server Sensor: 5.5 Systems affected HTTP Type Protocol Signature Vulnerability description A cookie is an identifier that is passed from a Web server to a Web browser. If the Web browser accepts the cookie, then subsequent accesses to the Web server will transmit the cookie along with the URL being requested, allowing the Web server to maintain state information about a user or session. Cookies provide client-based persistent state information. This information may allow a Web server to obtain information about where and what a Web client is doing, and is a privacy concern to some people. How to remove this vulnerability Some organizations have policies that prevent cookies from being used, to protect the organization from possible cookie snooping by Web servers. References CIAC Information Bulletin I-034 Internet Cookies http://www.ciac.org/ciac/bulletins/i-034.shtml ISS X-Force Cookies passed to Web browser http://xforce.iss.net/static/683.php Count.cgi allows remote users to view arbitrary GIF files (HTTP_Count) About this signature or vulnerability This signature detects a specially-crafted HTTP GET request for the Count.cgi program. Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.0, RealSecure Server Sensor: 5.5 Systems affected count.cgi: 2.3, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description Count.cgi is a popular CGI program by Muhammad Muquit that displays the number of raw hits on Web pages as an in-line image. A vulnerability in the Count.cgi program could allow a remote attacker to view any GIF file on the server by submitting specially 269 Dansie shopping cart backdoor allows attacker to execute arbitrary commands (HTTP_Dansie_Backdoor) crafted URL to the Count.cgi program. This vulnerability permits an attacker to view GIF files within or outside the server's root directory. How to remove this vulnerability Remove the count.cgi program from the cgi-bin directory. — OR — Upgrade to the latest version of count.cgi (2.4 or later), available from the Count Web site. See References. References Muhammad A Muquit Web site WWW Homepage Access Counter http://muquit.com/muquit/software/Count/Count.html BugTraq Mailing List, Fri Oct 10 1997 14:42:37 Security flaw in Count.cgi (wwwcount) http://www.securityfocus.com/archive/1/7762 CERT Advisory CA-1997-24 Buffer Overrun Vulnerability in Count.cgi cgi-bin Program http://www.cert.org/advisories/CA-1997-24.html AUSCERT Advisory AA-97.27 Buffer Overrun Vulnerability in Count.cgi cgi-bin Program http://www.auscert.org/Information/Advisories/aus_1997.html CERT Vendor-Initiated Bulletin VB-97.02 Security Hole in Guestbook Script for Web Servers Using SSI http://www.cert.org/vendor_bulletins/VB-97.02.sol_guestbook CIAC Information Bulletin I-013 Count.cgi Buffer Overrun Vulnerability http://www.ciac.org/ciac/bulletins/i-013.shtml ISS X-Force Count.cgi allows remote users to view arbitrary GIF files http://xforce.iss.net/static/586.php CVE CVE-1999-0021 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0021 Dansie shopping cart backdoor allows attacker to execute arbitrary commands (HTTP_Dansie_Backdoor) About this signature or vulnerability 270 This signature detects HTTP POST data that could be used to exploit a backdoor in the cart.pl application in some versions of the Dansie Shopping Cart. The form element and attempted command will be displayed in the DATA information field. This extra information may be in "www-form-urlencoded" format, meaning that spaces are replaced with '+' characters and other non-alphanumerics are represented in hexadecimal escape sequences (e.g., " %2F" instead of '/'). Dansie Shopping Cart contains hidden email routine (HTTP_Dansie_Cart) Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected Dansie Shopping Cart Type Unauthorized Access Attempt Vulnerability description Dansie Shopping Cart is a Web-based Perl shopping cart system. Dansie Shopping Cart version 3.0.4 contains a backdoor in the cart.pl (Perl) application, which could allow a remote attacker to execute arbitrary commands on the Web server. The backdoor is a form element consisting of a random nine-digit string of letters and numbers. How to remove this vulnerability No remedy available as of February 2001. References BugTraq Mailing List, Tue Apr 11 2000 02:24:06 Back Door in Commercial Shopping Cart http://www.securityfocus.com/archive/1/54851 ISS X-Force Dansie shopping cart backdoor allows attacker to execute arbitrary commands http://xforce.iss.net/static/4975.php CVE CVE-2000-0252 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0252 Dansie Shopping Cart contains hidden email routine (HTTP_Dansie_Cart) About this signature or vulnerability This signature detects HTTP GET requests (containing the string "usmbu7777") for the Dansie Shopping Cart files cart.cgi or cart.pl. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Dansie Shopping Cart Type Unauthorized Access Attempt Vulnerability description Dansie Shopping Cart is a CGI shopping cart program written in Perl. An email routine hidden in the source code sends an email to tech@dansie.net containing the Web address of the script and the IP address and server name of the host. 271 Dansie shopping cart allows retrieval of sensitive configuration information (HTTP_Dansie_Infoleak) How to remove this vulnerability No remedy available as of January, 2001. References InternetNews article Shopping Cart Program Leaves Back Door Open http://www.internetnews.com/ec-news/article/0,,4_340591,00.html InfoSec News article, "Back Door Mania" [ISN] Close The Door http://www.landfield.com/isn/mail-archive/2000/Aug/0062.html Craig Dansie Web site Dansie Shopping Cart http://www.dansie.net/cart.html Safe Networks Web site Danise Shopping Cart http://www.safenetworks.com/Others/scart2.html ISS X-Force Dansie Shopping Cart contains hidden email routine http://xforce.iss.net/static/4265.php Dansie shopping cart allows retrieval of sensitive configuration information (HTTP_Dansie_Infoleak) About this signature or vulnerability This signature detects an HTTP GET request to the cart.cgi or cart.pl object. The HTTP GET request contains "db", "env", or "vars" in the query. This HTTP GET request is most likely an attempt by an attacker to obtain configuration information about the Dansie Shopping Cart installation. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected Dansie Shopping Cart Type Unauthorized Access Attempt Vulnerability description Dansie Shopping Cart is a Web-based Perl shopping cart system. The cart.pl (Perl) application in Dansie Shopping Cart 3.0.4 handles form variables insecurely. By adding form variables, such as vars, env, or db to a URL, a remote attacker can obtain database or configuration information to modify the shopping cart contents. How to remove this vulnerability No remedy available as of February 2001. As a workaround, set the "personal option #66" to "HTTP_REFERER". This workaround only limits risk, and does not remove the vulnerability. An attacker can spoof the HTTP_REFERER field to bypass this workaround. 272 HTTP "dot dot" sequences (HTTP_DotDot) References BugTraq Mailing List, Fri Apr 14 2000 00:41:33 Re: more problems with that POS dansie cart software! http://www.securityfocus.com/archive/1/55550 ISS X-Force Dansie shopping cart allows retrieval of sensitive configuration information http://xforce.iss.net/static/4954.php CVE CVE-2000-0254 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0254 HTTP "dot dot" sequences (HTTP_DotDot) About this signature or vulnerability Additional Vulnerabilities Found This signature detects Web requests containing "dot dot" sequences. ■ http-alibaba-dotdot ■ ftgate-fileread ■ http-powerdynamo-dotdotslash ■ http-teamtrack-file-read Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected NCSA Servers: Old Versions Type Unauthorized Access Attempt Vulnerability description An attacker can traverse directories on the Web server by using "dot dot" (/../) sequences in URLs, allowing the attacker to read any file on the target HTTP server that is worldreadable or readable by the ID of the HTTP process. For example, a URL of the form (http://www.domain.com/..\..) allows anyone to browse and download files outside of the Web server content root directory. URLs such as (http://www.domain.com/ scripts..\..\) script-name could allow an attacker to execute the target script. An attacker can use a listing of this directory as additional information for planning a structured attack, or could download files elsewhere in the file system. How to remove this vulnerability Check with the vendor and documentation of your Web server software for information on configuring your server to remove this vulnerability. — OR — Upgrade to the latest version of your Web server software. Contact your vendor for more information. 273 Dragon Fire IDS allows remote command execution through dfire.cgi script (HTTP_DragonFire) References ISS X-Force HTTP "dot dot" sequences http://xforce.iss.net/static/106.php Dragon Fire IDS allows remote command execution through dfire.cgi script (HTTP_DragonFire) About this signature or vulnerability This signature detects an HTTP GET request for the Dragonfire CGI script file dfire.cgi with a pipe "|" character in one of its arguments. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected Dragon Fire IDS: 3.1 Type Unauthorized Access Attempt Vulnerability description The CGI script dfire.cgi, which is used by Dragon Fire Remote Web Interface version 1.0, could allow a remote attacker to use shell metacharacters to execute arbitrary commands and possibly compromise the system running Dragon Fire. How to remove this vulnerability No remedy available as of July 2000. As a workaround, apply the following patch: 1. Using vi, open the dfire.cgi file. 2. Go to line 215, which should look similar to the following: $command = $command . '-f ' . $db . $input{'database'} . '/dragon.db'; 3. Below this line, add the following two lines: $AOK = '-a-zA-Z0-9_.+:/'; $command =~ s/[^$AOK]/ /go; Dragon Fire should continue to function correctly. Confirm this by submitting a query. References BugTraq Mailing List, Wed Aug 04 1999 13:32:20 NSW Dragon Fire gets drowned http://www.securityfocus.com/archive/1/23247 ISS X-Force Dragon Fire IDS allows remote command execution through dfire.cgi script http://xforce.iss.net/static/3834.php CVE CAN-1999-0913 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0913 274 ECWare IIS CGI program denial of service (HTTP_ECware_DoS) ECWare IIS CGI program denial of service (HTTP_ECware_DoS) About this signature or vulnerability This signature detects an empty HTTP GET request to ecware.exe, which can cause your IIS server to hang and stop accepting other HTTP GET requests. False negatives RealSecure Network Sensor: The ECWare executable is vulnerable to other HTTP GET requests. This RealSecure signature checks for an HTTP GET request to ecware.exe that contains no data. HTTP GET requests with bad data can also cause the IIS server to hang. This signature will not detect those requests. RealSecure Server Sensor: The ECWare executable is vulnerable to other HTTP GET requests. This RealSecure signature checks for an HTTP GET request to ecware.exe that contains no data. HTTP GET requests with bad data can also cause the IIS server to hang. This signature will not detect those requests. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected ECware Pro, ECmerchant2000 Pro Type Denial of Service Vulnerability description ECware Pro 4.0, ECmerchant 2000 beta 3, and possibly other versions are vulnerable to a denial of service when used in conjunction with Microsoft Internet Information Server (IIS) 4. The ECware.exe CGI program does not exit properly when certain errors occur. If enough requests are made to ECware.exe, IIS stops responding to HTTP requests and fails to spawn additional ECware.exe processes when the CGI is called. IIS resumes functionality if the Web server is stopped and restarted. However, some ECware.exe processes may continue to run and consume memory on the system until the computer is rebooted. Other versions of ECware Pro and ECmerchant 2000 may also be vulnerable. How to remove this vulnerability Upgrade to ECmerchant 5.1 or later, available from the ECware Web site. See References. If your ECware or ECmerchant package is vulnerable, and you are victim to this attack, you can restart IIS by issuing the following commands: net stop w3svc net start w3svc References ECware Web site ECware Corporation http://www.ecware.com ISS X-Force ECWare IIS CGI program denial of service http://xforce.iss.net/static/4194.php 275 EZshopper loadpage.cgi could be used to execute arbitrary commands (HTTP_EZShopper_Loadpage) EZMall 2000 shopping cart misconfiguration exposes the order log (HTTP_EZMall2000) About this signature or vulnerability This signature detects an HTTP GET request for the EZ Mall 2000 order log file. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected EZMall 2000 Type Unauthorized Access Attempt Vulnerability description I-Soft's (formerly Seaside Enterprises) EZMall 2000 Web ordering system could potentially be misconfigured by an administrator. This misconfiguration could expose the order log file, which contains sensitive information about the purchase activity on the vulnerable site. How to remove this vulnerability Reinstall the I-Soft EZMall 2000 Shopping Cart application, following the installation instructions carefully. To prevent unauthorized remote access to sensitive I-Soft EZMall 2000 Shopping Cart files and directories, ensure that appropriate permissions have been set. References BugTraq Mailing List, Tue Apr 20 1999 13:34:57 Re: Shopping Carts exposing CC data http://www.securityfocus.com/archive/1/13363 I-Soft, LLC Web site Shopping Cart Software Program by EZMall 2000 http://www.ezmall2000.com/ ISS X-Force EZMall 2000 shopping cart misconfiguration exposes the order log http://xforce.iss.net/static/3859.php CVE CAN-1999-0606 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0606 EZshopper loadpage.cgi could be used to execute arbitrary commands (HTTP_EZShopper_Loadpage) About this signature or vulnerability 276 This signature detects someone attempting to open or execute files on your web server by exploiting the EZ Shopper 3.0 script named loadpage.cgi. EZshopper search.cgi could be used to execute arbitrary commands (HTTP_EZShopper_Search) Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected EZShopper: 3.0 Type Unauthorized Access Attempt Vulnerability description EZshopper 3.0 contains a script named loadpage.cgi that can give an attacker access to your Web server. EZshopper is a Perl-based e-commerce software package from AHG, Inc. Due to several flaws (lack of input validation and insecure use of the open() call) in the source code of the software, a remote attacker can pass a variable to loadpage.cgi that opens any file or executes any command with the privileges of the Web server. How to remove this vulnerability Upgrade to the latest version of EZ Shopper (3.0 or later), available from the AHG Web site. See References. References BugTraq Mailing List, Sun Feb 27 2000 00:42:35 EZ Shopper 3.0 shopping cart CGI remote command execution http://www.securityfocus.com/archive/1/48580 AHG Web site Ezshopper http://www.ahg.com ISS X-Force EZshopper loadpage.cgi could be used to execute arbitrary commands http://xforce.iss.net/static/4044.php CVE CAN-2000-0187 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0187 EZshopper search.cgi could be used to execute arbitrary commands (HTTP_EZShopper_Search) About this signature or vulnerability This signature detects someone attempting to open or execute files on your web server by exploiting the EZ Shopper 3.0 script named search.cgi. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected EZShopper: 3.0 277 HylaFax faxsurvey CGI allows execution of commands (HTTP_FaxSurvey) Type Unauthorized Access Attempt Vulnerability description EZshopper 3.0 contains a script named search.cgi that can give an attacker access to your Web server. EZshopper is a Perl-based e-commerce software package from AHG, Inc. Due to several flaws (lack of input validation and insecure use of the open() call) in the source code of the software, a remote attacker can pass a variable to search.cgi that opens any file or executes any command with the privileges of the Web server. How to remove this vulnerability Upgrade to the latest version of EZ Shopper (3.0 or later), available from the AHG Web site. See References. References BugTraq Mailing List, Sun Feb 27 2000 00:42:35 EZ Shopper 3.0 shopping cart CGI remote command execution http://www.securityfocus.com/archive/1/48580 AHG Web site Ezshopper http://www.ahg.com/software.htm#ezshopper ISS X-Force EZshopper search.cgi could be used to execute arbitrary commands http://xforce.iss.net/static/4045.php CVE CAN-2000-0188 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0188 HylaFax faxsurvey CGI allows execution of commands (HTTP_FaxSurvey) Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI), SuSE Linux Type Suspicious Activity Vulnerability description The faxsurvey CGI program included with some versions of the HylaFAX package could allow a remote attacker to execute commands on the Web server. The commands executed would be limited to those capable of being run by the owner of the server process, typcially as a "nobody" user. How to remove this vulnerability Apply the appropriate patch for your system, available from the HylaFAX Web site. See References. As a workaround, disable the faxsurvey CGI script. 278 FormMail CGI program multiple vulnerabilities (HTTP_FormMail) References BugTraq Mailing List, Tue Aug 04 1998 07:41:24 remote exploit in faxsurvey cgi-script http://www.securityfocus.com/archive/1/10161 HylaFAX Web site Windows Backdoors Update II: Net Bus 2.0 Pro, Caligula, and Picture.exe http://www.hylafax.org/patches/index.html ISS X-Force HylaFax faxsurvey CGI allows execution of commands http://xforce.iss.net/static/1532.php CVE CVE-1999-0262 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0262 FormMail CGI program multiple vulnerabilities (HTTP_FormMail) About this signature or vulnerability This signature detects an HTTP POST request to a FormMail CGI program, which may or may not exist on your network. False positives RealSecure Network Sensor: This signature detects all HTTP POST requests to all versions of the FormMail CGI program, including versions that are not vulnerable to the remote execution vulnerability or the remote usage vulnerability. Also, RealSecure only detects HTTP POST requests from the Web client, which does not necessarily indicate that the FormMail program even exists on your network. RealSecure Server Sensor: This signature detects all HTTP POST requests to all versions of the FormMail CGI program, including versions that are not vulnerable to the remote execution vulnerability or the remote usage vulnerability. Also, RealSecure only detects HTTP POST requests from the Web client, which does not necessarily indicate that the FormMail program even exists on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected FormMail Type Unauthorized Access Attempt Vulnerability description Matt Wright's FormMail CGI program is subject to the following vulnerabilities: ● remote execution of arbitrary commands on the server (FormMail version 1.0) ● unauthorized remote usage of the FormMail program itself (FormMail version 1.3) The remote execution vulnerability in FormMail version 1.0 allows a remote attacker to execute arbitrary commands on the server. 279 FrontPage Server Extensions device name denial of service (HTTP_FrontPage_DeviceName) The remote usage vulnerability in FormMail version 1.3 allows an unauthorized remote Web server to use for its own sites your Web server's FormMail program. How to remove this vulnerability Upgrade to the latest version of FormMail (1.6 or later), available from the FormMail Web site. See References. References BugTraq Mailing List, Wed Aug 02 1995 21:28:43 SECURITY HOLE: FormMail http://www.securityfocus.com/archive/1/3545 Matt's Script Archive: FormMail Downloading http://www.worldwidemart.com/scripts/formmail.shtml ISS X-Force FormMail CGI program multiple vulnerabilities http://xforce.iss.net/static/4917.php FrontPage Server Extensions device name denial of service (HTTP_FrontPage_DeviceName) About this signature or vulnerability This signature detects an HTTP GET request containing a device name reference appended to a call to shtml.exe. This GET request could indicate an attempt by an attacker to execute a denial of service attack or determine the physical path of the server components. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected FrontPage Server Extensions: 1.1 Type Denial of Service Vulnerability description FrontPage 2000 Server Extensions version 1.1 is vulnerable to a remote denial of service attack. By requesting a URL using the shtml.exe component of FrontPage 2000 Server Extensions, an attacker can overflow a buffer and also determine the physical path of the server components by including a DOS device name in the GET request. As a result, FrontPage operations slow down and the server shows 100 percent CPU utilization until the GET request times out. After the GET request times out, CPU utilization decreases and the server returns to normal. How to remove this vulnerability Upgrade to the latest Service Release (1.2 or later) for FrontPage 2000, available from the MSDN Online Web Workshop. See References. References Xato Network Security, Inc. Security Advisory XATO-082000-01 FRONTPAGE SERVER EXTENSIONS SHTML.EXE DENIAL OF SERVICE http://www.xato.net/Reference/xato-082000-01.htm 280 FrontPage Server Extensions Visual Studio RAD Support sub-component buffer overflow MSDN Online Web Workshop Microsoft FrontPage 2000 Server Extensions: Downloads for Microsoft Windows-Based Servers http://msdn.microsoft.com/workshop/languages/fp/2000/winfpse.asp ISS X-Force FrontPage Server Extensions device name denial of service http://xforce.iss.net/static/5124.php CVE CAN-2000-0710 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0710 FrontPage Server Extensions Visual Studio RAD Support subcomponent buffer overflow (HTTP_Frontpage_Extensions_RAD_Overflow) About this signature or vulnerability This signature detects URLs containing references to the files fp30reg.dll or fp4areg.dll, followed by an overly long string. Such URLs could indicate an attacker's attempt to overflow a buffer in Microsoft IIS (Internet Information Server) servers running FrontPage Server Extensions with the Visual Studio RAD Support sub-component. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.3 Systems affected Windows NT, Windows NT: 4.0, Microsoft IIS: 4.0, Windows 2000, FrontPage 2000 Server Extensions, Windows 2000: Server, Microsoft IIS: 5.0, Windows 2000: Advanced Server Type Protocol Signature Vulnerability description Microsoft FrontPage Server Extensions (FPSE) for Windows NT and Windows 2000 is vulnerable to a buffer overflow in the Visual Studio RAD (Remote Application Deployment) Support sub-component. FrontPage Server Extensions are components used in Microsoft Internet Information Server (IIS) versions 4.0 and 5.0. If the Visual Studio RAD Support sub-component is installed, a remote attacker can send a specially-crafted packet to the server to overflow a buffer. An attacker could exploit this vulnerability to execute arbitrary code on the system and possibly gain complete control over the affected Web server. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS01-035. See References. Windows NT Apply the Windows NT4.0 'FrontPage Server Extension Unchecked Buffer' security patch, as detailed in Microsoft Security Bulletin MS01-035. Windows 2000 281 HTTP get (HTTP_Get) Ensure that Windows 2000 Service Pack 2 is installed and apply the Windows 2000 'FrontPage Server Extension Unchecked Buffer' security patch, as detailed in Microsoft Security Bulletin MS01-035. References Microsoft Security Bulletin MS01-035 FrontPage Server Extension Sub-Component Contains Unchecked Buffer http://www.microsoft.com/technet/security/bulletin/MS01-035.asp NSFOCUS Security Advisory SA2001-03 Microsoft FrontPage 2000 Server Extensions Buffer Overflow Vulnerability http://www.nsfocus.com/english/homepage/sa01-03.htm CIAC Information Bulletin L-100 FrontPage Sub-Component Vulnerability http://www.ciac.org/ciac/bulletins/l-100.shtml ISS X-Force FrontPage Server Extensions Visual Studio RAD Support sub-component buffer overflow http://xforce.iss.net/static/6730.php CVE CVE-2001-0341 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0341 HTTP get (HTTP_Get) About this signature or vulnerability This signature detects that a computer on your network has submitted an HTTP GET request to a Web server. This signature allows an administrator to track, log and view Web traffic on the network. False positives RealSecure Network Sensor: Lists of sites accessed can be reviewed for compliance with the organization's "Acceptable Use" policy. Internal publication of summaries of where everyone is vitising with their browsers is often very effective both for user education about acceptable use of the network, and to discourage internal misuse. RealSecure Server Sensor: Lists of sites accessed can be reviewed for compliance with the organization's "Acceptable Use" policy. Internal publication of summaries of where everyone is vitising with their browsers is often very effective both for user education about acceptable use of the network, and to discourage internal misuse. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5.2 Systems affected HTTP Type Protocol Signature 282 Glimpse Web server allows remote command execution (HTTP_Glimpse) Vulnerability description Pages, images, and all other information viewed through a Web browser on the World Wide Web are transferred through HTTP using the GET command. HTTP GET decoding discovers all Web pages being transmitted insecurely to a computer. How to remove this vulnerability Some organizations have policies that prevent the use of Web browsers in order to protect the organization from possible malicious intent. Lists of sites accessed can be reviewed for compliance with the organization's "Acceptable Use" policy. Internal publication of summaries of where users have visited with their browsers can be effective both for user education about acceptable use of the network and to discourage internal misuse. References ISS X-Force HTTP get http://xforce.iss.net/static/654.php Glimpse Web server allows remote command execution (HTTP_Glimpse) About this signature or vulnerability Additional Vulnerabilities Found This signature detects an attack against the glimpse cgi-bin script present with certain httpd Web servers. ■ http-cgi-glimpse-vuln Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected Glimpse: 2.0, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The aglimpse CGI script shipped with Glimpse HTTP version 2.0 and WebGlimpse versions prior to 1.5 could allow a remote attacker to execute commands on a Web server with the privileges of the user running the httpd process. Depending on the configuration of the Web server, this could allow the attacker to gain root or administrator access to the host. In any case, this vulnerability allows the attacker to alter the contents of the Web site. How to remove this vulnerability Disable access to the aglimpse CGI script until you can upgrade to the latest version of WebGlimpse (2.0.03 or later), available from the Webglimpse Web site. See References. GlimpseHTTP is no longer supported by the makers of Webglimpse. 283 Guestbook could allow execution of commands from remote (HTTP_Guestbook) References GlimpseHTTP Home Pages GlimpseHTTP security http://sunsite.bilkent.edu.tr/pub/infosystems/Glimpse/security.html CERT Vendor-Initiated Bulletin VB-97.13 Vulnerability in GlimpseHTTP and WebGlimpse CGI scripts http://www.cert.org/vendor_bulletins/VB-97.13.GlimpseHTTP.WebGlimpse WebGlimpse Web site The site for cooperative development of Glimpse & Webglimpse http://webglimpse.org/ ISS X-Force Glimpse Web server allows remote command execution http://xforce.iss.net/static/297.php Guestbook could allow execution of commands from remote (HTTP_Guestbook) About this signature or vulnerability This signature detects an HTTP GET request for the Guestbook CGI script, which may be running on a Web server. False positives RealSecure Network Sensor: RealSecure only detects the execution of this script, not the exploitation of it. Even if you apply the remedy, RealSecure will continue to detect the use of this script. RealSecure Server Sensor: RealSecure only detects the execution of this script, not the exploitation of it. Even if you apply the remedy, RealSecure will continue to detect the use of this script. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The guestbook CGI program allows a remote attacker to execute arbitrary commands on a Web server. This is present in Selena Sol's guestbook on servers with Server Side Includes (SSI) enabled. How to remove this vulnerability Modify the guestbook.setup file, adding the word exec to the comma delimited @bad_words variable. — OR — Modify the guestbook.setup file so that the @allow_html variable is set to no. 284 HTTP HEAD request detected (HTTP_Head) References CERT Vendor-Initiated Bulletin VB-97.02 Security Hole in Guestbook Script for Web Servers Using SSI http://www.cert.org/vendor_bulletins/VB-97.02.sol_guestbook Extropia.com Guestbook Security http://www.extropia.com/scripts/guestbook_security.html ISS X-Force Guestbook could allow execution of commands from remote http://xforce.iss.net/static/321.php CVE CVE-1999-0237 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0237 HTTP HEAD request detected (HTTP_Head) About this signature or vulnerability This signature detects an HTTP HEAD request on the network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected Any Type Suspicious Activity Vulnerability description An HTTP HEAD request, which is similar to an HTTP GET request, has been detected on the network. The HTTP GET command is used to transfer pages, images, and other content viewed through a Web browser. Although similar to GET requests, HEAD requests have been used by CGI scanners and exploits to remain hidden from Intrusion Detection Systems (IDS), which only detect HTTP GET requests. While HTTP HEAD requests do happen normally, they are rare. As a result, they often indicate that an attacker is trying to bypass an IDS. How to remove this vulnerability HTTP HEAD requests may indicate an attacker attempting to bypass an IDS. Determine if this HEAD request is suspicious by examining the Web address associated with the event. References ISS X-Force HTTP HEAD request detected http://xforce.iss.net/static/4703.php 285 Htmlscript CGI allows remote file reading (HTTP_HTMLScript) Home Free CGI search.cgi script allows remote directory listings (HTTP_HomeFree_Search) About this signature or vulnerability This signature detects someone attempting to view directory listings by exploiting the search.cgi script. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI), Home Free CGI Type Unauthorized Access Attempt Vulnerability description Home Free is a collection of free CGI Perl scripts for Windows NT and Unix systems. A vulnerability in the search.cgi program allows a user to issue the letter variable and view directory listings on the vulnerable server. How to remove this vulnerability No remedy available as of January 2000. References BugTraq Mailing List, Mon Jan 03 2000 17:52:23 Another search.cgi vulnerability http://www.securityfocus.com/archive/1/40593 ISS X-Force Home Free CGI search.cgi script allows remote directory listings http://xforce.iss.net/static/3882.php CVE CAN-2000-0054 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0054 Htmlscript CGI allows remote file reading (HTTP_HTMLScript) About this signature or vulnerability This signature detects specially-crafted HTTP GET requests for the search97.vts CGI script, which could indicate attempts by an attacker to read arbitrary files on the system. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI) 286 Internet Explorer 3.0 allows remote command execution (HTTP_IE3_URL) Type Unauthorized Access Attempt Vulnerability description A vulnerability in the Miva Corporation htmlscript CGI program could allow a remote user to read files on the server. Any file that can be read by the user running the server (usually "nobody") can also be accessed from the htmlscript CGI script. This vulnerability is present in versions of the htmlscript CGI program previous to 2.9932. How to remove this vulnerability Htmlscript has been acquired by Miva Corporation. Contact Miva technical support for upgrade or patch information. Disable htmlscript on your server until you are able to patch this vulnerability, or if you are unable to obtain a fix for this vulnerability. References BugTraq Mailing List, Tue Jan 27 1998 17:28:53 Security flaw in htmlscript http://www.securityfocus.com/archive/1/8460 ISS X-Force Htmlscript CGI allows remote file reading http://xforce.iss.net/static/1466.php CVE CVE-1999-0264 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0264 Internet Explorer 3.0 allows remote command execution (HTTP_IE3_URL) Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected Microsoft Internet Explorer: 3.0, Microsoft Internet Explorer: 3.01 Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Explorer versions 3.0 and 3.01 could allow a Web site to execute an arbitrary program on a computer running Microsoft Windows and browsing the Web using Microsoft Internet Explorer. By exploiting this vulnerability, an attacker who has created a malicious Web site can execute commands on another user's computer. When someone using Microsoft Internet Explorer 3.0 or 3.01 connects to the attacker's Web site, the HTML code written by the attacker can execute commands or even create a login on the visiting client's computer. How to remove this vulnerability Upgrade to the latest version of Internet Explorer (3.02 or later), available from the Microsoft Web site. See References. 287 Win32 Web servers remote command execution through .CMD and .BAT files (HTTP_IE_BAT) References Microsoft Web site Internet Explorer Home Page http://www.microsoft.com/windows/ie/ Security Bugware Web site Internet Explorer #1 http://focus.silversand.net/vulner/allbug/ie.html Security Bugware Web site Internet Explorer #2 http://focus.silversand.net/vulner/allbug/ie2.html ISS X-Force Internet Explorer 3.0 allows remote command execution http://xforce.iss.net/static/463.php CVE CVE-1999-0280 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0280 Win32 Web servers remote command execution through .CMD and .BAT files (HTTP_IE_BAT) Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 5.5 Systems affected Microsoft IIS: 1.0 Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) version 1.0 could allow a remote attacker to execute commands on the server by using .BAT and .CMD files. It is believed that this vulnerability affects other servers in addition to IIS. Contact your vendor for more information. Using this vulnerability, an attacker could create a malicious Web site. When someone using IE 3.0 connects to this Web site, the HTML code written by the attacker can execute commands or create a login on the visiting client's system. How to remove this vulnerability Apply the .CMD /.BAT Patch, as listed in Microsoft Knowledge Base Article Q148188. See References. As a workaround, disable .BAT and .CMD file extensions for external CGI scripts in the mapping feature of the IIS WWW server, as listed in Microsoft Knowledge Base Article Q148188. See References. — OR — 288 IIS ASP DATA issue could reveal source code (HTTP_IIS$DATA) Apply the latest Windows NT Service Pack (3.51 or later) for Microsoft IIS, as listed in Microsoft Knowledge Base Article Q148188. See References. References Microsoft Knowledge Base Article Q148188 Internet Information Server Security .CMD /.BAT Patch http://support.microsoft.com/support/kb/articles/q148/1/88.asp Microsoft Knowledge Base Article Q155056 IIS Security Concern Using Batch Files for CGI http://support.microsoft.com/support/kb/articles/q155/0/56.asp ISS X-Force Win32 Web servers remote command execution through .CMD and .BAT files http://xforce.iss.net/static/63.php CVE CVE-1999-0233 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0233 IIS ASP DATA issue could reveal source code (HTTP_IIS$DATA) Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected Microsoft IIS: 2.0, Microsoft IIS: 3.0, Microsoft IIS: 4.0, Microsoft IIS: 1.0 Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) is vulnerable to a source code disclosure, caused by how IIS handles the multiple data streams NTFS provides for files. By appending the string "::$DATA" to an HTTP request for a file, an attacker could view the contents of a file that is normally set to be acted upon by an Application Mapping, such as Active Server Pages (ASP). An attacker who has gained read access to such a file could view sensitive or potentially proprietary information within the source of the file. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS98-003. See References. References Microsoft Security Bulletin MS98-003 File Access Issue with Windows NT Internet Information Server (IIS) http://www.microsoft.com/technet/security/bulletin/ms98-003.asp Microsoft Knowledge Base Article Q188806 ::$DATA Data Stream Name of a File May Return Source http://support.microsoft.com/support/kb/articles/q188/8/06.asp NTBugtraq Mailing List ASP vulnerability with Alternate Data Streams 289 IIS ASP dot bug (HTTP_IIS3_Asp_Dot) http://www.ntbugtraq.com/ default.asp?pid=36&sid=1&A2=ind9807&L=ntbugtraq&F=P&S=&P=921 Allaire Security Bulletin ASB99-03 ASB99-03: Microsoft Internet Information Server Exposure of Source Code with '::$DATA' http://www.allaire.com/handlers/index.cfm?ID=8729 Microsoft Web site Microsoft Windows Web Services (IIS) Web site http://www.microsoft.com/technet/iis/ CIAC Information Bulletin I-068 File Access Issue With Internet Information Server http://www.ciac.org/ciac/bulletins/i-068.shtml ISS X-Force IIS ASP DATA issue could reveal source code http://xforce.iss.net/static/1125.php CVE CVE-1999-0278 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0278 IIS ASP dot bug (HTTP_IIS3_Asp_Dot) About this signature or vulnerability Additional Vulnerabilities Found This signature detects an HTTP request for an Active Server Page (ASP) file with a dot ("."), which could indicate an attempt by an attacker to view the source of ASP files on a Microsoft Internet Information Server. ■ http-iis-aspsource ■ http-iis-2e Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected Microsoft IIS: 3.0 and earlier Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) versions 2.0 and 3.0 display the source of Active Server Pages (ASP files) if a period is appended to the URL. In addition, scripting information to other data in the file can be viewed. Potentially proprietary Web server files (such as .ASP, .HTX, and .IDC file name extensions) may contain sensitive information (such as user IDs and passwords) embedded in the source code, which is normally not available to remote users. 290 IIS 4.0/5.0 escaped percent found (HTTP_IIS_Double_Eval_Evasion) How to remove this vulnerability Upgrade to the latest version of Microsoft Internet Information Server (5.0 or later), available from the Microsoft Windows Web Services (IIS) Web site. See References. If upgrading to the latest version of IIS is not possible, download and apply the iis-fix patch, available from the Microsoft FTP site. See References. As a workaround, disable read permissions for the ASP directory in the Internet Service Manager. This may not be a practical solution since many sites mix ASP and HTML files. If your site mixes these files together in the same directories, segregate them immediately. ASP files should be treated as any other Web-based executable and kept in separate directories where permissions can be adjusted. References Microsoft Knowledge Base Article Q163485 Active Server Pages Script Appears in Browser http://support.microsoft.com/support/kb/articles/q163/4/85.asp BugTraq Mailing List, Thu Feb 20 1997 13:51:04 Re: [NTSEC] ! [ADVISORY] Major Security Hole in MS ASP http://www.securityfocus.com/archive/1/6332 BugTraq Mailing List, Thu Feb 20 1997 09:39:01 ! [ADVISORY] Major Security Hole in MS ASP http://www.securityfocus.com/archive/1/6330 Microsoft Knowledge Base Article Q164059 IIS Execution File Text Can Be Viewed in Client http://support.microsoft.com/support/kb/articles/q164/0/59.asp ISS X-Force IIS ASP dot bug http://xforce.iss.net/static/336.php CVE CAN-1999-0154 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0154 IIS 4.0/5.0 escaped percent found (HTTP_IIS_Double_Eval_Evasion) About this signature or vulnerability This signature detects a URL containing double percent character sequences, such as "%25". This could indicate an attacker's attempt to use escaped sequences to bypass an intrusion detection system. See also HTTP_IIS_Percent_Evasion, HTTP_IIS_Unicode_Evasion, and HTTP_IIS_UTF8_Evasion. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 3.3, RealSecure Server Sensor: 6.5 Systems affected Microsoft IIS: 4.0, Microsoft IIS: 5.0 Type Protocol Signature 291 IIS idq.dll ISAPI extension buffer overflow (HTTP_IIS_Index_Server_Overflow) Vulnerability description Microsoft IIS (Internet Information Server) versions 4.0 and 5.0 incorrectly evaluate URLs twice for escape sequences. In an attempt to bypass intrusion detection systems, an attacker may submit to an IIS server a URL containing escape sequences (such as %25) representing percent (%) characters. How to remove this vulnerability No remedy available as of October 2001. References ISS X-Force IIS 4.0/5.0 escaped percent found http://xforce.iss.net/static/7202.php IIS 4.0/5.0 malformed hex sequence (HTTP_IIS_Hex_Evasion) About this signature or vulnerability This signature detects invalid hex sequences (such as "%)f") in submitted URLs. Such URLs may indicate an attacker's attempt to bypass an intrusion detection system. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 3.3, RealSecure Server Sensor: 6.5 Systems affected Microsoft IIS: 4.0, Microsoft IIS: 5.0 Type Protocol Signature Vulnerability description Microsoft IIS (Internet Information Server) versions 4.0 and 5.0 translate certain forms of malformed hex sequences (such as "%)f"). IIS will process any escape sequence as long as it contains at least one valid hexadecimal character. In an attempt to bypass an intrusion detection system, an attacker may submit to the IIS server a URL containing such malformed hex sequences. How to remove this vulnerability No remedy available as of October 2001. References ISS X-Force IIS 4.0/5.0 malformed hex sequence http://xforce.iss.net/static/7199.php IIS idq.dll ISAPI extension buffer overflow (HTTP_IIS_Index_Server_Overflow) About this signature or vulnerability 292 This signature detects an attempt to access an IIS (Internet Information Server) IDA (Indexing Service) object with overly long arguments. This event could indicate an attacker's attempt to crash the IIS service or execute arbitrary code on the system by exploiting a buffer overflow condition. IIS idq.dll ISAPI extension buffer overflow (HTTP_IIS_Index_Server_Overflow) Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Server Sensor: 6.0.1 Systems affected Windows NT, Windows NT: 4.0, Microsoft IIS: 4.0, Windows 2000, Microsoft Index Server: 2.0, Microsoft IIS: 5.0, Microsoft Indexing Service: All versions, Microsoft IIS: 6.0 beta, Windows: XP beta Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) versions 4.0, 5.0, and 6.0 beta are vulnerable to a buffer overflow in the handling of ISAPI (Internet Services Application Programming Interface) extensions. An unchecked buffer in the code that handles idq.dll ISAPI extensions in the Indexing Service for IIS could allow a remote attacker to overflow a buffer and execute code by sending a specially-crafted Indexing Service request. An attacker could exploit this vulnerability to gain complete control over the affected server. This vulnerability is exploitable via the "Code Red" and "Code Red II" worm. The "Code Red" worm is a self-propagating worm that scans random IP addresses on port 80 searching for vulnerable Web servers. Once a vulnerable Web server is found, the worm performs malicious activity before propagating to other vulnerable hosts. The "Code Red II" worm does not deface Web sites, as the original version of the worm did, but it carries a more serious threat -- it contains a Trojan Horse payload, which could allow any remote attacker to further compromise infected systems. The "Code Red II" worm also has the ability to scan for vulnerable hosts much faster than previous versions, which has already been reported to cause failures in certain network components by overloading them with network traffic. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS01-033. See References. Windows NT Apply the "Unchecked Buffer in Index Server ISAPI Extension Could Enable Web Server Compromise" security update to Microsoft Index Server 2.0 as detailed in Microsoft Security Bulletin MS01-033. Alternatively, if they are not required, disable the .IDA and .IDQ mappings as follows: 1. In the Internet Service Manager, select Properties for the Web site. 2. Select the tab for Directory, Home Directory or Virtual Directory. 3. Under Applications, click Configuration. 4. Select the App Mappings tab. 5. Select the .IDA or .IDQ mapping and click Remove. Windows 2000 Apply the "Unchecked Buffer in Index Server ISAPI Extension Could Enable Web Server Compromise" security update to Indexing Service in Windows 2000 as detailed in Microsoft Security Bulletin MS01-033. Alternatively, if they are not required, disable the .IDA and .IDQ mappings as follows: 1. In the Internet Service Manager, select Properties for the Web site. 2. Select the tab for Directory, Home Directory or Virtual Directory. 3. Under Applications, click Configuration. 4. Select the App Mappings tab. 5. Select the .IDA or .IDQ mapping and click Remove. 293 IIS idq.dll ISAPI extension buffer overflow (HTTP_IIS_Index_Server_Overflow) References eEye Digital Security Team Alert AD20010618 All versions of Microsoft Internet Information Services Remote buffer overflow (SYSTEM Level Access) http://www.eeye.com/html/Research/Advisories/AD20010618.html Microsoft Security Bulletin MS01-033 Unchecked Buffer in Index Server ISAPI Extension Could Enable Web Server Compromise http://www.microsoft.com/technet/security/bulletin/MS01-033.asp Internet Security Systems Security Alert #79 Remote IIS Index Server ISAPI Extension Buffer Overflow http://xforce.iss.net/alerts/advise79.php CERT Vulnerability Note VU#952336 Microsoft Index Server/Indexing Service used by IIS 4.0/5.0 contains unchecked buffer used when encoding double-byte characters https://www.kb.cert.org/vuls/id/952336 CERT Advisory CA-2001-13 Buffer Overflow In IIS Indexing Service DLL http://www.cert.org/advisories/CA-2001-13.html CIAC Information Bulletin L-098 Microsoft Index Server ISAPI Extension Buffer Overflow http://www.ciac.org/ciac/bulletins/l-098.shtml IBM Managed Security Services Outside Advisory Redistribution MSS-OAR-E012001:224.1 Microsoft Security Bulletin MS01-033: Unchecked Buffer in Index Server ISAPI Extension Could Enable Web Server Compromise http://www-1.ibm.com/services/continuity/recover1.nsf/advisories/ 85256A3400529A8685256A700047905E/$file/oar224.txt CERT Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL http://www.cert.org/advisories/CA-2001-19.html CERT Advisory CA-2001-23 Continued Threat of the "Code Red" Worm http://www.cert.org/advisories/CA-2001-23.html Cisco System Field Notice July 20, 2001 "Code Red" Worm - Customer Impact http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml Internet Security Systems Security Alert #89 X-Force Response to Concern About the "Code Red" Worm http://xforce.iss.net/alerts/advise89.php Internet Security Systems Security Alert #90 Resurgence of "Code Red" Worm Derivatives http://xforce.iss.net/alerts/advise90.php 294 IIS 5.0 ISAPI Internet Printing Protocol extension buffer overflow (HTTP_IIS_ISAPI_Printer_Overflow) CERT Incident Note IN-2001-09 "Code Red II:" Another Worm Exploiting Buffer Overflow In IIS Indexing Service DLL http://www.cert.org/incident_notes/IN-2001-09.html CIAC Information Bulletin L-120 Cisco "Code Red" Worm Impact http://www.ciac.org/ciac/bulletins/l-120.shtml CIAC Information Bulletin L-117 The Code Red Worm http://www.ciac.org/ciac/bulletins/l-117.shtml ISS X-Force IIS idq.dll ISAPI extension buffer overflow http://xforce.iss.net/static/6705.php CVE CAN-2001-0500 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0500 IIS 5.0 ISAPI Internet Printing Protocol extension buffer overflow (HTTP_IIS_ISAPI_Printer_Overflow) About this signature or vulnerability This signature detects any HTTP request for any file with an extension of ".printer." False positives RealSecure Network Sensor: A false positive is possible if a legitimate user is using ISAPI Printer Extensions for valid reasons. However, most published exploits for this vulnerability use "null.printer." Requests for this particular file could indicate the activity of an attacker. RealSecure Server Sensor: A false positive is possible if a legitimate user is using ISAPI Printer Extensions for valid reasons. However, most published exploits for this vulnerability use "null.printer." Requests for this particular file could indicate the activity of an attacker. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Server Sensor: 6.0.1 Systems affected Windows 2000, Microsoft IIS: 5.0, Windows 2000: Server, Windows 2000: Advanced Server, Windows 2000: Datacenter Server Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) version 5.0 installed on Microsoft Windows 2000 is vulnerable to a buffer overflow in the handling of ISAPI (Internet Services Application Programming Interface) extensions. An unchecked buffer exists in the code that handles input parameters for the Internet Printing Protocol (IPP) ISAPI extension. By 295 IIS 5.0 ISAPI Internet Printing Protocol extension buffer overflow (HTTP_IIS_ISAPI_Printer_Overflow) sending a specially-crafted Internet Printing request to the server, an attacker can overflow a buffer to allow the modification of IPP ISAPI extension functionality. An attacker can use this vulnerability to gain complete control over the affected server. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS01-023. See References. Windows 2000 Apply the "Unchecked Buffer in ISAPI Extension Could Enable Compromise of IIS 5.0 Server" security patch as detailed in Microsoft Security Bulletin MS01-023. Alternatively, if not required, disable the .printer mapping as follows: 1. In the Internet Service Manager, select Properties for the Web site. 2. Select the tab for Directory, Home Directory or Virtual Directory. 3. Under Applications, click Configuration. 4. Select the App Mappings tab. 5. Select the .printer mapping and click Remove. References Microsoft Security Bulletin MS01-023 Unchecked Buffer in ISAPI Extension Could Enable Compromise of IIS 5.0 Server http://www.microsoft.com/technet/security/bulletin/MS01-023.asp eEye Digital Security Team Alert AD20010501 Windows 2000 IIS 5.0 Remote buffer overflow vulnerability (Remote SYSTEM Level Access) http://www.eeye.com/html/Research/Advisories/AD20010501.html CERT Advisory CA-2001-10 Buffer Overflow Vulnerability in Microsoft IIS 5.0 http://www.cert.org/advisories/CA-2001-10.html BugTraq Mailing List, Tue May 01 2001 13:15:10 Windows 2000 IIS 5.0 Remote buffer overflow vulnerability (Remote SYSTEM Level Access) http://www.securityfocus.com/archive/1/181109 BugTraq Mailing List, Thu May 03 2001 08:09:07 How to remove .printer mapping (WAS RE: Permanently remove IIS pr inter mapping) http://www.securityfocus.com/archive/1/181906 BugTraq Mailing List, Thu May 03 2001 23:08:38 IIS 5 remote exploit. http://www.securityfocus.com/archive/1/181937 BugTraq Mailing List, Wed May 02 2001 20:04:43 Re: Permanently remove iis printer mapping http://www.securityfocus.com/archive/1/181931 BugTraq Mailing List, Sun May 13 2001 06:12:02 IIS5 .printer exploit ported to perl and win32 http://www.securityfocus.com/archive/1/184535 BugTraq Mailing List, Wed May 02 2001 09:57:42 Re: Windows 2000 IIS 5.0 Remote buffer overflow vulnerability (Remote SYSTEM Level Access) http://www.securityfocus.com/archive/1/181420 296 IIS allows remote attackers to obtain source code fragments using +.htr (HTTP_IIS_Obtain_Code) Microsoft Technet Secure Internet Information Services 5 Checklist http://www.microsoft.com/technet/security/iis5chk.asp CERT Vulnerability Note VU#516648 Microsoft Windows 2000/Internet Information Server (IIS) 5.0 Internet Printing Protocol (IPP) ISAPI contains buffer overflow (MS01-023) http://www.kb.cert.org/vuls/id/516648 CIAC Information Bulletin L-078 Microsoft Unchecked Buffer in ISAPI Extension http://www.ciac.org/ciac/bulletins/l-078.shtml Internet Security Systems Security Alert #75 Remote IIS ISAPI Printer Extension Buffer Overflow http://xforce.iss.net/alerts/advise75.php ISS X-Force IIS 5.0 ISAPI Internet Printing Protocol extension buffer overflow http://xforce.iss.net/static/6485.php CVE CVE-2001-0241 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0241 IIS allows remote attackers to obtain source code fragments using +.htr (HTTP_IIS_Obtain_Code) About this signature or vulnerability This signature detects HTTP GET requests that include the string "+.htr", which could indicate an attempt by an attacker to view the source of files on the Web server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2, RealSecure Server Sensor: 6.5 Systems affected Microsoft IIS: 4.0, Microsoft Personal Web Server: 4.0, Microsoft IIS: 5.0 Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) versions 4.0 and 5.0 could allow a remote attacker to obtain source code fragments under restricted conditions, due to a variant of the "File Fragment Reading via .HTR" vulnerability. (For more information about the "File Fragment Reading via .HTR" vulnerability, see Microsoft Security Bulletin MS00-031. See References.) By sending a URL request with an appended +.htr, an attacker could be sent parts of the .ASP (Active Server Page) source code. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS01-004. See References. 297 IIS allows remote attackers to obtain source code fragments using +.htr (HTTP_IIS_Obtain_Code) Microsoft first addressed the "File Fragment Reading via .HTR" vulnerability in Microsoft Security Bulletin MS00-031. However, new variants of this vulnerability have resulted in the release of an additional Microsoft Security Bulletins and updated patches. The most current patch for this vulnerability is available in Microsoft Security Bulletin MS01-004. For best security practices, if .HTR functionality is not required, disable the .HTR script mapping, as listed in Microsoft Security Bulletin MS01-004. See References. References Microsoft Security Bulletin MS00-044 Patch Available for “Absent Directory Browser Argument” Vulnerability http://www.microsoft.com/technet/security/bulletin/MS00-044.asp Microsoft Security Bulletin MS00-044 FAQ Microsoft Security Bulletin (MS00-044): Frequently Asked Questions http://www.microsoft.com/technet/security/bulletin/fq00-044.asp Microsoft Security Bulletin MS00-031 Patch Available for "Undelimited .HTR Request" and "File Fragment Reading via .HTR" Vulnerabilities http://www.microsoft.com/technet/security/bulletin/ms00-031.asp Microsoft Security Bulletin MS01-004 Patch Available for New Variant of “File Fragment Reading via .HTR” Vulnerability http://www.microsoft.com/technet/security/bulletin/MS01-004.asp ISBASE Security Advisory SA2000-02 IIS ISM.DLL truncation exposes file content http://www.securityfocus.com/advisories/2412 Allaire Security Bulletin ASB00-20 Patch Available for "Absent Directory Browser Argument" Vulnerability http://www.securityfocus.com/advisories/2460 BugTraq Mailing List, Fri Aug 04 2000 11:39:00 More information on MS00-044 Date: Fri Aug 04 2000 11:39:00 http://www.securityfocus.com/archive/1/74153 CERT Vulnerability Note VU#28565 Microsoft Internet Information Server (IIS) discloses contents of files via crafted request containing "+.htr" http://www.kb.cert.org/vuls/id/28565 ISS X-Force IIS allows remote attackers to obtain source code fragments using +.htr http://xforce.iss.net/static/5104.php CVE CVE-2000-0630 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0630 298 IIS and SiteServer Showcode.asp sample file allows remote file viewing (HTTP_IIS_Showcode) IIS 4.0/5.0 malformed double percent sequence (HTTP_IIS_Percent_Evasion) About this signature or vulnerability This signature detects invalid hex sequences (such as "%%35c") in submitted URLs. Such URLs may indicate an attacker's attempt to bypass an intrusion detection system. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 3.3, RealSecure Server Sensor: 6.5 Systems affected Microsoft IIS: 4.0, Microsoft IIS: 5.0 Type Protocol Signature Vulnerability description Microsoft IIS (Internet Information Server) versions 4.0 and 5.0 mistranslate double percent sequences (%%). Whereas other Web servers would translate %%35c to a literal "%35c" with no further translation, IIS will perform two translations: the first to "%5c" and then to "/". In this example, IIS will translate the double percent to a percent, but will continue to translate in escape mode, translating the hexadecimal 35 to a '5', then translating the resulting "%5c" to a slash "/". In an attempt to bypass an intrusion detection system, an attacker may submit to the IIS server URLs containing such double percent sequences. How to remove this vulnerability No remedy available as of October 2001. References ISS X-Force IIS 4.0/5.0 malformed double percent sequence http://xforce.iss.net/static/7201.php IIS and SiteServer Showcode.asp sample file allows remote file viewing (HTTP_IIS_Showcode) About this signature or vulnerability This signature detects an attempt to access the "showcode.asp" sample file used by IIS 4.0 and SiteServer 3.x. This may indicate an attacker's attempt to read arbitrary files on the server. False positives RealSecure Network Sensor: A false positive is possible for access attempts for benign files coincidentally named "showcode.asp." A false positive is also possible for access attempts to patched (invulnerable) copies of this file. RealSecure Server Sensor: A false positive is possible for access attempts for benign files coincidentally named "showcode.asp." A false positive is also possible for access attempts to patched (invulnerable) copies of this file. Default risk level Medium 299 IIS %u Unicode encoding detected (HTTP_IIS_Unicode_Encoding) Sensors that have this signature RealSecure Network Sensor: XPU 3.2, RealSecure Server Sensor: 6.5 Systems affected Microsoft IIS: 4.0, Microsoft Site Server: All versions Type Suspicious Activity Vulnerability description The showcode.asp sample file shipped with Microsoft Internet Information Server (IIS) 4.0 and SiteServer 3.x can be remotely exploited to read arbitrary files on vulnerable servers. This file is one of several sample files distributed with IIS 4.0 and SiteServer 3.x that allow remote file viewing. How to remove this vulnerability Remove the showcode.asp file from your servers. As a rule, sample code and example applications should not be installed on production servers. References @stake, Inc./L0pht Security Advisory 05/07/99 Microsoft IIS 4.0 Web Server http://www.atstake.com/research/advisories/1999/showcode.txt Microsoft Security Bulletin MS99-013 Patches Available for File Viewers Vulnerability http://www.microsoft.com/technet/security/bulletin/ms99-013.asp Microsoft Knowledge Base Article Q231368 Solution Available for File Viewers Vulnerability http://support.microsoft.com/support/kb/articles/q231/3/68.asp WebTrends Press Release WebTrends Corporation Discovers New Microsoft Site Server & IIS Security Vulnerabilities http://www.webtrends.com/news/releases/release.asp?id=81 Microsoft Knowledge Base Article Q232449 Sample ASP Code May be Used to View Unsecured Server Files http://support.microsoft.com/support/kb/articles/q232/4/49.asp ISS X-Force IIS and SiteServer Showcode.asp sample file allows remote file viewing http://xforce.iss.net/static/2381.php CVE CAN-1999-0736 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0736 IIS %u Unicode encoding detected (HTTP_IIS_Unicode_Encoding) About this signature or vulnerability 300 This signature detects HTTP requests that contain "%u" followed by a particular series of hexadecimal characters. Such "%u" requests could indicate an attacker's attempts to bypass an intrusion detection system. RealSecure decodes these %u requests and may trigger additional events based on the content of the requests. IIS Unicode translation error allows remote command execution (HTTP_IIS_Unicode_Translation) Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.2, RealSecure Server Sensor: 6.5 Systems affected Microsoft IIS: 4.0, Microsoft IIS: 5.0 Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) allows Unicode characters to be encoded in URL requests in a format that uses "%u". Such encoded characters appear as "%uXXXX", where "XXXX" represents hexadecimal characters (0-9, A-F). For example, the character 'a' can be encoded as %u0061. A remote attacker can use this form of encoding to attempt to bypass intrusion detection systems. How to remove this vulnerability No remedy available as of August 2001. References Internet Security Systems Security Alert #95 Multiple Vendor IDS Unicode Bypass Vulnerability http://xforce.iss.net/alerts/advise95.php eEye Digital Security Advisory AD20010705 %u encoding IDS bypass vulnerability http://www.eeye.com/html/Research/Advisories/AD20010705.html CIAC Information Bulletin L-139 Microsoft IIS "%u encoding IDS bypass vulnerability" http://www.ciac.org/ciac/bulletins/l-139.shtml ISS X-Force IIS %u Unicode encoding detected http://xforce.iss.net/static/6994.php CVE CAN-2001-0669 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0669 IIS Unicode translation error allows remote command execution (HTTP_IIS_Unicode_Translation) About this signature or vulnerability This signature detects HTTP GET requests that include certain Unicode characters. Such GET requests may indicate an attacker's attempts to bypass IIS (Internet Information Server) security mechanisms. False negatives RealSecure Network Sensor: A unique version of this Unicode attack is possible for each language supported by Windows NT. This signature only detects attacks against the English version of Windows NT. This signature has not yet been tested in attacks against other language versions of Windows NT. Also, this signature will only detect specific HTTP GET requests that attempt to run an .exe file. 301 IIS Unicode translation error allows remote command execution (HTTP_IIS_Unicode_Translation) RealSecure Server Sensor: A unique version of this Unicode attack is possible for each language supported by Windows NT. This signature only detects attacks against the English version of Windows NT. This signature has not yet been tested in attacks against other language versions of Windows NT. Also, this signature will only detect specific HTTP GET requests that attempt to run an .exe file. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Server Sensor: 6.0.1 Systems affected Windows NT, Microsoft IIS: 4.0, Windows 2000, Microsoft IIS: 5.0 Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) versions 4.0 and 5.0 are vulnerable to a canonicalization error when using foreign Unicode character sets. An attacker could send a specially-crafted URL containing Unicode characters that represent slashes ("/") and backslashes ("\") to access files and folders on the Web server with the privileges of the IUSR_ account (an anonymous user account for IIS). This vulnerability may yield additional privileges that could allow the attacker to add, delete, or modify files, or execute commands on the server. This vulnerability may be exploited via the "Code Blue" worm. See Internet Security Systems Security Alert #96 for more information. See References. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS00-078. See References. Windows NT Apply the "Web Server Folder traversal" patch detailed in Microsoft Security Bulletin MS00-078. Windows 2000 Apply the "Web Server Folder traversal" patch detailed in Microsoft Security Bulletin MS00-078. References Microsoft Security Bulletin MS00-078 Patch Available for 'Web Server Folder Traversal' Vulnerability http://www.microsoft.com/technet/security/bulletin/MS00-078.asp Microsoft Security Bulletin MS00-078 FAQ Microsoft Security Bulletin (MS00-078): Frequently Asked Questions http://www.microsoft.com/technet/security/bulletin/fq00-078.asp BugTraq Mailing List, Tue Oct 17 2000 09:48:03 IIS %c1%1c remote command execution http://www.securityfocus.com/archive/1/140091 302 IIS %u Unicode wide character encoding detected (HTTP_IIS_Unicode_Wide_Encoding) BugTraq Mailing List, Fri Oct 20 2000 03:30:48 [LoWNOISE] addendum %c1%1c IIS 4.0/5.0 Remote command execution http://www.securityfocus.com/archive/1/140620 BugTraq Mailing List, Wed Oct 18 2000 23:21:23 IIS 4.0/5.0 UNICODE exploit http://www.securityfocus.com/archive/1/140349 BugTraq Mailing List, Wed Oct 18 2000 15:35:31 Re: IIS %c1%1c remote command execution http://www.securityfocus.com/archive/1/140214 Internet Security Systems Security Alert #68 Serious flaw in Microsoft IIS UNICODE translation http://xforce.iss.net/alerts/advise68.php CERT Vulnerability Note VU#111677 Microsoft IIS 4.0 / 5.0 vulnerable to directory traversal via extended unicode in url http://www.kb.cert.org/vuls/id/111677 CERT Advisory CA-2001-11 sadmind/IIS Worm http://www.cert.org/advisories/CA-2001-11.html CIAC Information Bulletin L-007 Microsoft IIS Folder Traversal http://www.ciac.org/ciac/bulletins/l-007.shtml Internet Security Systems Security Alert #96 Code Blue Worm http://xforce.iss.net/alerts/advise96.php ISS X-Force IIS Unicode translation error allows remote command execution http://xforce.iss.net/static/5377.php CVE CAN-2000-0884 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0884 IIS %u Unicode wide character encoding detected (HTTP_IIS_Unicode_Wide_Encoding) About this signature or vulnerability This signature detects HTTP requests that contain "%u" followed by a particular series of hexadecimal characters. Such "%u" requests could indicate an attacker's attempts to bypass an intrusion detection system. RealSecure does not decode the HTTP request but will report the exact request string as is. False positives RealSecure Network Sensor: A false positive is possible if the detected encoded wide characters represent foreign language characters in an otherwise legitimate (nonmalicious) HTTP request. RealSecure Server Sensor: A false positive is possible if the detected encoded wide 303 IIS %u Unicode wide character encoding detected (HTTP_IIS_Unicode_Wide_Encoding) characters represent foreign language characters in an otherwise legitimate (nonmalicious) HTTP request. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.2, RealSecure Server Sensor: 6.5 Systems affected Microsoft IIS: 4.0, CiscoSecure IDS, Microsoft IIS: 5.0, Snort: prior to 1.8.1 Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) allows wide characters to be Unicode encoded in URL requests in a format that uses "%u". Such encoded characters appear as "%uXXXX", where "XXXX" represents hexadecimal characters (0-9, A-F). For example, the character 'a' can be encoded as "%u0061" . A remote attacker can use this form of encoding to attempt to bypass intrusion detection systems. Many public ".ida" overflow exploits (including the CodeRed worms) use this type of encoding when executing a buffer overflow attempt. How to remove this vulnerability For RealSecure Network Sensor 5.x, 6.x: Apply the latest RealSecure Network Sensor XPress Update (XPU 3.2 or later), as listed in Internet Security Systems Security Alert #95. See References. For RealSecure Server Sensor 6.0: Upgrade to the latest version of RealSecure Server Sensor (6.0.1 or later), as listed in Internet Security Systems Security Alert #95. See References. For Cisco Secure Intrusion Detection System (Netranger): Apply the latest service pack as listed in Cisco Systems Field Notice, September 5, 2001. See References. For Snort prior to 1.8.1: Upgrade to the latest version of Snort (1.8.1 or later) available at: http://www.snort.org/downloads.html References Internet Security Systems Security Alert #95 Multiple Vendor IDS Unicode Bypass Vulnerability http://xforce.iss.net/alerts/advise95.php eEye Digital Security Advisory AD20010705 %u encoding IDS bypass vulnerability http://www.eeye.com/html/Research/Advisories/AD20010705.html Cisco Systems Field Notice, September 5, 2001 Cisco Secure Intrusion Detection System Signature Obfuscation Vulnerability http://www.cisco.com/warp/public/707/cisco-intrusion-detection-obfuscation-vulnpub.shtml CIAC Information Bulletin M-001 Cisco Secure IDS Signature Obfuscation Vulnerability http://www.ciac.org/ciac/bulletins/m-001.shtml CIAC Information Bulletin L-139 Microsoft IIS "%u encoding IDS bypass vulnerability" http://www.ciac.org/ciac/bulletins/l-139.shtml 304 IIS URL decoding error could allow remote code execution (HTTP_IIS_URL_Decoding) ISS X-Force IIS %u Unicode wide character encoding detected http://xforce.iss.net/static/6995.php CVE CAN-2001-0669 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0669 IIS URL decoding error could allow remote code execution (HTTP_IIS_URL_Decoding) About this signature or vulnerability This signature detects specific HTTP GET requests that contain "double-escaped" periods, slashes, or back-slashes. Such HTTP GET requests may indicate an attacker's attempts to bypass security mechanisms in IIS (Internet Information Server) URL decoding routines. False positives RealSecure Network Sensor: Some legitimate sites may convert certain characters of the URL into "escaped" characters (e.g., "%2E") or "double escaped" characters (e.g., "%252E"). A false positive is possible if users visit legitimate sites that use certain "double escaped" URLs (containing "double-escaped" characters), which this signature uses to detect this vulnerability. RealSecure Server Sensor: Some legitimate sites may convert certain characters of the URL into "escaped" characters (e.g., "%2E") or "double escaped" characters (e.g., "%252E"). A false positive is possible if users visit legitimate sites that use certain "double escaped" URLs (containing "double-escaped" characters), which this signature uses to detect this vulnerability. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Server Sensor: 6.0.1 Systems affected Windows NT, Windows NT: 4.0, Microsoft IIS: 4.0, Windows 2000, Microsoft IIS: 5.0, Microsoft Peer Web Services Type Unauthorized Access Attempt Vulnerability description A vulnerability in the URL decoding routines in Microsoft Internet Information Server (IIS) versions 4.0 and 5.0 could allow a remote attacker to execute arbitrary code on the IIS server. When IIS receives a query on a server-side script, it performs a decoding pass on the request. A primary decoding routine converts the string into canonical form, security checks are performed to ensure the validity of the request, then a second decoding routine parses parameters following the filename. However, IIS mistakenly parses the filename a second time with these additional parameters. A remote attacker could exploit this vulnerability by sending a specially-crafted URL containing ".." ("dot dot") and "/" characters to bypass security mechanisms within the URL decoding routines. This vulnerability could allow the attacker to view directory structures, view and delete files, execute arbitrary commands, or cause a denial of service. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS01-026 . See References. 305 IIS URL decoding error could allow remote code execution (HTTP_IIS_URL_Decoding) Windows NT Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS01-026. Windows 2000 Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS01-026. References Microsoft Security Bulletin MS01-026 Superfluous Decoding Operation Could Allow Command Execution via IIS http://www.microsoft.com/technet/security/bulletin/MS01-026.asp NSFOCUS Security Advisory SA2001-02 Microsoft IIS CGI Filename Decode Error Vulnerability http://www.nsfocus.com/english/homepage/sa01-02.htm CERT Advisory CA-2001-12 Superfluous Decoding Vulnerability in IIS http://www.cert.org/advisories/CA-2001-12.html Internet Security Systems Security Alert #77 IIS URL Decoding Vulnerability http://xforce.iss.net/alerts/advise77.php CERT Vulnerability Note VU#789543 IIS decodes filenames superfluously after applying security checks http://www.kb.cert.org/vuls/id/789543 CIAC Information Bulletin L-083 Microsoft CGI Filename Decode Error Vulnerability in IIS http://www.ciac.org/ciac/bulletins/l-083.shtml Bright Eyes Research Group Advisory # be00001e Remote users can execute any command on several IIS 4.0 and 5.0 systems by using UTF codes http://security.instock.ru/rus/advisories/advisories.htm/be00001e.txt BugTraq Mailing List, Wed Sep 19 2001 19:12:16 RE: New vulnerability in IIS4.0/5.0 http://www.securityfocus.com/archive/1/215342 Microsoft Security Bulletin MS01-044 15 August 2001 Cumulative Patch for IIS http://www.microsoft.com/technet/security/bulletin/MS01-044.asp CIAC Information Bulletin L-132 Microsoft Cumulative Patch for IIS http://www.ciac.org/ciac/bulletins/l-132.shtml ISS X-Force IIS URL decoding error could allow remote code execution http://xforce.iss.net/static/6534.php 306 IIS ExAir sample site denial of service (HTTP_IISExAir_DoS) CVE CVE-2001-0333 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0333 UTF8 found in the HTTP data (HTTP_IIS_UTF8_Evasion) About this signature or vulnerability This signature detects invalid hex sequences (such as "%c0%af") in submitted URLs. Such URLs may indicate an attacker's attempt to bypass an intrusion detection system. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 3.3, RealSecure Server Sensor: 6.5 Systems affected Microsoft IIS: 4.0, Microsoft IIS: 5.0 Type Protocol Signature Vulnerability description UTF8 (Universal Character Set Transformation Format 8) is a means of encoding 16-bit Unicode characters as multibyte character sequences so that Unicode characters can be mixed in a string with normal ASCII characters. In a string that contains UTF8 encodings, ASCII characters are represented by their normal values. Unicode characters are represented by 2, 3, or 4 byte sequences, although Microsoft IIS (Internet Information Server) only supports 2 and 3 byte sequences. Bytes with values of 0xc0 or higher represent the start of a UTF8 encoding. For example, an escape sequence of %c0%af in a URL is a 2 byte UTF8 encoding. How to remove this vulnerability No remedy available as of October 2001. References BugTraq Mailing List, Oct 4 2001 1:04PM On IDS Evasion, Vulnerabilities, and Vendor Hype http://www.securityfocus.com/cgi-bin/archive.pl?id=1&mid=218563 ISS X-Force UTF8 found in the HTTP data http://xforce.iss.net/static/7200.php IIS ExAir sample site denial of service (HTTP_IISExAir_DoS) About this signature or vulnerability This signature detects specially-crafted HTTP GET requests for one of many specific .asp (active server page) files, which may indicate an attacker's attempt to cause a denial of service on an installation of Microsoft Internet Information Server (IIS). Default risk level Medium 307 IIS buffer overflow in HTR requests can allow remote code execution (HTTP_IISHTR_Overflow) Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Microsoft IIS: 4.0 Type Denial of Service Vulnerability description Installations of Internet Information Server (IIS) version 4.0 that include the "ExAir" sample site pages are vulnerable to a denial of service attack. If certain ExAir .asp (active server page) pages are requested directly and not from the main page, the pages do not load the needed DLLs correctly, and the server's CPU usage increases to 100%. By submitting such a request for these .asp pages, an attacker can exhaust all CPU resources on the server. How to remove this vulnerability Remove the IIS ExAir Sample Site from your installation of IIS. More information is available in the Getting Started with the Windows NT 4.0 Option Pack white paper, available from the Microsoft Web site. See References. References BugTraq Mailing List, Tue Jan 26 1999 16:35:41 IIS 4 Advisory - ExAir sample site DoS http://www.securityfocus.com/archive/1/12161 Microsoft Web Site Getting Started with the Windows NT 4.0 Option Pack http://www.microsoft.com/ntserver/appservice/deployment/planguide/ntopdg.asp ISS X-Force IIS ExAir sample site denial of service http://xforce.iss.net/static/2229.php CVE CVE-1999-0449 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0449 IIS buffer overflow in HTR requests can allow remote code execution (HTTP_IISHTR_Overflow) Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT, Windows NT: 4.0, Microsoft IIS: 4.0 Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Information Server (IIS) version 4.0 is vulnerable to a denial of service attack caused by a buffer overflow involving the way that .HTR, .STM, and .IDC files are processed. IIS version 4.0 can perform various server-side processing with specific file 308 IIS buffer overflow in HTR requests can allow remote code execution (HTTP_IISHTR_Overflow) types. Requests for files ending with .HTR, .STM, and .IDC extensions are passed to the appropriate external DLL for processing. By sending a malformed request, an attacker can overflow a buffer and cause the service to crash. It may be possible for an attacker to use this vulnerability to execute arbitrary code on the system. How to remove this vulnerability Apply the Internet Information Server 4.0 ext-fix update. Additional steps can be used to prevent issues similar to this one from impacting any Microsoft IIS 4.0 Server. IIS 4.0 can be forced to check if the requested script exists or if the user has permission to the requested script. If the user does not have permission to view the requested script, the appropriate warning message is returned to the browser and the script engine is not invoked. To set this functionality: 1. In Internet Service Manager (ISM), double-click Internet Information Server. 2. Right-click the computer name and then click Properties on the menu that appears. 3. In the Master Properties drop-down box, click WWW Service, and then click Edit. 4. Click the Home Directory tab and then click Configuration. 5. Double-click the line in the extension mappings that contains .HTR. 6. Select the check box labeled "Check if file exists". 7. Repeat these steps for STM and IDC application mappings. 8. Close the ISM. Windows NT Apply the Internet Information Server 4.0 ext-fix update. Internet Information Server 4.0 users, apply the ext-fix update: 1. Open a web browser. 2. Go to ftp://ftp.microsoft.com/ bussys/IIS/iis-public/fixes/usa/ext-fix/. 3. View the readme.txt for versions and install instructions. 4. Download the appropriate patch for your operating environment. 5. Find the patch file you downloaded to your computer. 6. Double-click its icon to start the installation. 7. Follow the installation directions. Additional steps can be used to prevent issues similar to this one from impacting any Microsoft IIS 4.0 Server. IIS 4.0 can be forced to check if the requested script exists or if the user has permission to the requested script. If not, the appropriate warning message is returned to the browser and the script engine is not invoked. This functionality can be set as follows: 1. In Internet Service Manager (ISM), double-click Internet Information Server. 2. Right-click the computer name and then click Properties on the menu that appears. 3. In the Master Properties drop-down box, click "WWW Service", and then click "Edit". 4. Click the "Home Directory" tab and then click "Configuration". 5. Double-click the line in the extension mappings that contains ".HTR". 6. Select the check box labeled "Check if file exists". 7. Repeat these steps for STM and IDC application mappings. 8. Close the ISM. References eEye Digital Security Team Alert AD06081999 Retina vs. IIS4, Round 2 http://www.eeye.com/html/Research/Advisories/AD19990608.html Microsoft Security Bulletin MS99-019 Workaround Available for 'Malformed HTR Request' Vulnerability http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/ bulletin/MS99-019.asp 309 Microsoft Index Server idq.dll allows remote directory traversal (HTTP_IndexServer_IDQ) CIAC Information Bulletin J-048 Malformed HTR Request Vulnerability http://ciac.llnl.gov/ciac/bulletins/j-048.shtml Microsoft Knowledge Base Article Q234905 An Improperly Formatted HTTP Request Can Cause The Inetinfo Process To Fail http://support.microsoft.com/support/kb/articles/q234/9/05.asp CERT Advisory CA-1999-07 IIS Buffer Overflow http://www.cert.org/advisories/CA-1999-07.html Internet Security Systems Security Alert #28 Malformed HTR File Vulnerability in Microsoft Internet Information Server 4.0 http://xforce.iss.net/alerts/advise28.php ISS X-Force IIS buffer overflow in HTR requests can allow remote code execution http://xforce.iss.net/static/2281.php CVE CVE-1999-0874 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0874 Microsoft Index Server idq.dll allows remote directory traversal (HTTP_IndexServer_IDQ) About this signature or vulnerability This signature detects someone attempting to view files on your web server by exploiting the idq.dll file in Microsoft Index Server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected Windows NT: 4.0, Microsoft IIS Index Server: 2.0 Type Unauthorized Access Attempt Vulnerability description Microsoft Index Server could allow a remote attacker to view files on the Web server. Microsoft Index Server is a Web search engine included in the Windows NT 4.0 Option Pack. A vulnerability in the idq.dll file allows a remote attacker to search outside virtual directories by requesting a specially-crafted URL. Attackers can use this vulnerability to view any file on the Web server root drive, if they know or can guess the file name. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS00-006. See References. 310 Microsoft Index Server webhits.dll allows remote directory traversal (HTTP_IndexServer_Webhits) In addition, ensure that your IDQ files restrict user input so that only .HTX files are capable of formatting the output. Some sample files do not sufficiently restrict user input. Sample files should always be removed from production servers. References Microsoft Security Bulletin MS00-006 Patch Available for "Malformed Hit-Highlighting Argument" Vulnerability http://www.microsoft.com/technet/security/bulletin/ms00-006.asp @stake, Inc./Cerberus Information Security Advisory CISADV000202 IDQ http://www.atstake.com/research/advisories/2000/adviisidq.html ISS X-Force Microsoft Index Server idq.dll allows remote directory traversal http://xforce.iss.net/static/4232.php CVE CAN-2000-0126 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0126 Microsoft Index Server webhits.dll allows remote directory traversal (HTTP_IndexServer_Webhits) About this signature or vulnerability This signature detects someone attempting to view files on your web server by exploiting the webhits.dll file in Microsoft Index Server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected Windows NT, Windows 2000, Microsoft Index Server: 2.0 Type Unauthorized Access Attempt Vulnerability description Microsoft Index Server could allow a remote attacker to view files on the Web server. Microsoft Index Server is a Web search engine included in the Windows NT 4.0 Option Pack and incorporated as Indexing Services in Windows 2000. A vulnerability in the webhits.dll file allows a remote attacker to search outside virtual directories by requesting a specially-crafted URL. Attackers can use this vulnerability to view any file on the Web server root drive, if they know or can guess the file name. How to remove this vulnerability Obtain the appropriate patch for your system, as listed in Microsoft Security Bulletin MS00-006. See References. Windows NT Apply the “Malformed Hit-Highlighting Argument” patch detailed in Microsoft Security Bulletin MS00-006 to Index Server 2.0 311 info2www script allows remote execution of commands (HTTP_Info2WWW) Windows 2000 Apply the “Malformed Hit-Highlighting Argument” patch detailed in Microsoft Security Bulletin MS00-006 to Indexing Services for Windows 2000 References Microsoft Security Bulletin MS00-006 Patch Available for "Malformed Hit-Highlighting Argument" Vulnerability http://www.microsoft.com/technet/security/bulletin/ms00-006.asp @stake, Inc./Cerberus Information Security Advisory CISADV000126 Webhits.dll buffer truncation http://www.atstake.com/research/advisories/2000/adviishtw.html ISS X-Force Microsoft Index Server webhits.dll allows remote directory traversal http://xforce.iss.net/static/3884.php CVE CVE-2000-0097 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0097 info2www script allows remote execution of commands (HTTP_Info2WWW) False positives RealSecure Network Sensor: A false positive is possible for legitimate uses of the script. RealSecure Server Sensor: A false positive is possible for legitimate uses of the script. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The info2www script is a program used to convert GNU Info Nodes into HTML for viewing over the Web. A vulnerability in some versions of this script prior to 1.2 could allow a remote attacker to execute arbitrary commands with the privilege of the user owning the server process, usually "nobody." Other scripts (such as info2html and infogate) from which the info2www script may have been derived may also be vulnerable. Generally, the script is vulnerable if it calls open() without parsing metacharacters from the HTTP request. How to remove this vulnerability Disable all info2www CGI scripts prior to version 1.2, as well as any versions of the info2html and infogate scripts, which may also be vulnerable. 312 HTTP Java (HTTP_Java) References BugTraq Mailing List, Tue Mar 03 1998 03:26:49 Vulnerabilites in some versions of info2www CGI http://www.securityfocus.com/archive/1/8658 ISS X-Force info2www script allows remote execution of commands http://xforce.iss.net/static/1732.php CVE CVE-1999-0266 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0266 HTTP Java (HTTP_Java) About this signature or vulnerability This signature detects when a Web browser attempts to obtain a file containing Java bytecode. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected HTTP, Java Type Protocol Signature Vulnerability description Web browsers that have Java enabled may access files that contain Java code from remote Web sites. It is possible for Java code to contain malicious commands. How to remove this vulnerability Some organizations have policies that prevent Java from being used, to protect the organization from possible hostile applets. If your policy does not allow Java to be used, disable Java in the user's Web browser. References CNET News.Com Article, August 30, 1999, 12:25 p.m. PT Malicious Java code uses IE to access computers http://news.cnet.com/news/0-1003-204-346600.html CERT Tech Tips FAQ Frequently Asked Questions About Malicious Web Scripts Redirected by Web Sites http://www.cert.org/tech_tips/malicious_code_FAQ.html ISS X-Force HTTP Java http://xforce.iss.net/static/655.php 313 WebLogic allows users to read source of JSP files (HTTP_JSP_SourceRead) jj CGI program could allow remote command execution (HTTP_JJ) About this signature or vulnerability This signature detects specially-crafted HTTP GET requests for cgi-bin/jj (the jj CGI demonstration program), which may indicate attempts by an attacker to execute code on the system. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The jj CGI program distributed with some HTTP servers is used as a demonstration program. A vulnerability in this program could allow a remote attacker to execute arbitrary commands with the same permissions as the CGI script by shell escaping from the /bin/mail program (on systems that support such a feature). To exploit this vulnerability, an attacker must have knowledge of the program's password. However, several default passwords are known, including "HTTPDrocks" and "SDGROCKS." How to remove this vulnerability Remove the jj CGI program from the CGI-BIN directory. As a rule, sample code, example applications, tutorials and documentation should not be installed on production servers. References BugTraq Mailing List, Tue Dec 24 1996 18:30:20 jj cgi http://www.securityfocus.com/archive/1/6021 ISS X-Force jj CGI program could allow remote command execution http://xforce.iss.net/static/1808.php CVE CVE-1999-0260 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0260 WebLogic allows users to read source of JSP files (HTTP_JSP_SourceRead) About this signature or vulnerability This signature detects the use of ".JSP" (an all-caps extension) in a URL. Default risk level Medium 314 MachineInfo script reveals system information (HTTP_MachineInfo) Sensors that have this signature RealSecure Network Sensor: XPU 2.2, RealSecure Server Sensor: 6.5 Systems affected WebLogic Type Unauthorized Access Attempt Vulnerability description BEA WebLogic Server is vulnerable to source code disclosure of Java Server Pages (JSP files). By requesting a JSP file from the server with the file extension changed from lowercase (.jsp) to uppercase (.JSP), an attacker can cause the Web server to reveal the source code for the requested JSP file. Potentially proprietary Web server files, such as Java Server Pages, may contain sensitive information (such as user IDs and passwords) embedded in the source code. How to remove this vulnerability Set the following property in the weblogic.properties file, as listed in BEA security lockdown documentation (see References): weblogic.httpd.servlet.extensionCaseSensitive=true References BugTraq Mailing List, Mon Jun 12 2000 02:19:45 BEA WebLogic JSP showcode vulnerability http://www.securityfocus.com/archive/1/64356 FreeBSD, Inc. Security Advisory FreeBSD-SA-01:08 New BEA WebLogic showcode vulnerability discovered by Foundstone, Inc. http://www.foundstone.com/cgi-bin/display.cgi?Content_ID=36 BEA WebLogic WebLogic Server HTTP Configuration http://www.weblogic.com/docs51/admindocs/lockdown.html ISS X-Force WebLogic allows users to read source of JSP files http://xforce.iss.net/static/4694.php CVE CVE-2000-0499 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0499 MachineInfo script reveals system information (HTTP_MachineInfo) False positives RealSecure Network Sensor: A false positive is possible for legitimate uses of the script. RealSecure Server Sensor: A false positive is possible for legitimate uses of the script. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5.2 315 IIS unauthorized ODBC data access with RDS (HTTP_MDAC_Access) Systems affected IRIX: 6.3, Common Gateway Interface (CGI) Type Pre-attack Probe Vulnerability description The CGI script MachineInfo is installed by default on some IRIX systems. This script provides detailed information about the computer on which it is running. This information includes the type and speed of the processor, memory, and other details regarding installed hardware. This information could be useful to an attacker in performing an attack. How to remove this vulnerability Remove the MachineInfo script from the CGI bin directory of your Web server. References SGI Security Advisory 19970501-02-PX IRIX webdist.cgi, handler and wrap programs ftp://patches.sgi.com/support/free/security/advisories/19970501-02-PX CERT Advisory CA-1997-12 Vulnerability in webdist.cgi http://www.cert.org/advisories/CA-1997-12.html AUSCERT Advisory AA-97.14 SGI IRIX webdist.cgi Vulnerability ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-97.14.SGI.webdist.cgi.vul Cisco Systems Network Security Database SGI MachineInfo CGI script http://www.opensystems.com/support/docs/6332/vul_334.html BugTraq Mailing List, May 7 1997 5:02AM Re: SGI Security Advisory 19970501-01-A - Vulnerability in webdist.cgi http://www.securityfocus.com/cgi-bin/archive.pl?id=1&mid=6705 ISS X-Force MachineInfo script reveals system information http://xforce.iss.net/static/1730.php CVE CAN-1999-1067 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1067 IIS unauthorized ODBC data access with RDS (HTTP_MDAC_Access) About this signature or vulnerability This signature detects an HTTP POST request to /msadc/msadcs.dll. False positives RealSecure Network Sensor: A false positive is possible if a legitimate HTTP POST request is made to /msadc/msadcs.dll. 316 IIS unauthorized ODBC data access with RDS (HTTP_MDAC_Access) RealSecure Server Sensor: A false positive is possible if a legitimate HTTP POST request is made to /msadc/msadcs.dll. Default risk level High Sensors that have this signature RealSecure Network Sensor: SR 1.1, RealSecure Server Sensor: 6.5 Systems affected Windows NT, Microsoft IIS: 4.0, Microsoft Data Access Components (MDAC): All versions, Windows 2000 Type Unauthorized Access Attempt Vulnerability description Microsoft Data Access Components (MDAC) versions 2.1 and earlier, in the default configuration, could allow a remote attacker to access OLE database sources. Remote Data Services (RDS), one of the components of MDAC, is designed to permit remote data access to authenticated users through Microsoft Internet Information Server (IIS). A vulnerability in the DataFactory object of RDS could allow an attacker to use a Web client to send a SQL query to OLE database datasources. If the remote server is available to the Windows NT IIS server, and the attacker knows the correct IP address, SQL account and password, and database name, the attacker could retrieve the query results through the Web client. This vulnerability is compounded by the fact that many SQL databases contain a default administrator username ("sa") with a null password. In addition, under some configurations this vulnerability could allow an attacker to execute shell commands or access files on the IIS server as a privileged user. How to remove this vulnerability Upgrade to the latest version of MDAC, version 2.5 or later, as described in Microsoft Security Bulletin (MS99-025): Frequently Asked Questions. See References. Remove Sample Pages for RDS on production systems. Delete the directory, including all of its subfolders: %systemdrive%\program files\common files\system\msadc\samples — OR — If RDS functionality is not needed, delete the /msadc virtual directory from the default Web site. Windows NT Delete the following registry keys from the Registry Editor or a batch file: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters \ADCLaunch\RDSServer.DataFactory HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters \ADCLaunch\AdvancedDataFactory HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters \ADCLaunch\VbBusObj.VbBusObjCls Using the Registry Editor, delete the registry keys as follows: 1. Open the Registry Editor. From the Windows NT Start menu, select Run. Type regedt32 and click OK. 2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters 317 IIS unauthorized ODBC data access with RDS (HTTP_MDAC_Access) \ADCLaunch registry key. 3. Select the RDSServer.DataFactory key. 4. From the Edit menu, select Delete and verify the deletion. 5. Repeat steps 3 and 4 to delete the AdvancedDataFactory and VbBusObj.VbBusObjCls keys. --OR-- Use the REGDEL.exe command-line utility to remove DataFactory functionality. REGDEL.exe is a tool available as part of the Windows NT Resource Kit utilities that can be used to delete registry entries from the command line: 1. Copy the following text into a .bat file (for example, c:\dfremove.bat) and run the batch file on machines on which you want to remove the RDS components. REM Batch file to remove RDS components REM Make sure that REGDEL.exe from the Resource Kit is in your PATH REGDEL "SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\AdvancedDa taFactory" REGDEL "SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\RDSServer.D ataFactory" REGDEL "SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\VbBusObj.V bBusObjCls" Echo RDS Keys Removed 2. Execute or run the batch file on the web server. Windows 2000 Delete the following registry keys from the Registry Editor or a batch file: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters \ADCLaunch\RDSServer.DataFactory HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters \ADCLaunch\AdvancedDataFactory HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters \ADCLaunch\VbBusObj.VbBusObjCls Using the Registry Editor, delete the registry keys as follows: 1. Open the Registry Editor. From the Windows NT Start menu, select Run. Type regedt32 and click OK. 2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters \ADCLaunch registry key. 3. Select the RDSServer.DataFactory key. 4. From the Edit menu, select Delete and verify the deletion. 5. Repeat steps 3 and 4 to delete the AdvancedDataFactory and VbBusObj.VbBusObjCls keys. --OR-- Use the REGDEL.exe command-line utility to remove DataFactory functionality. REGDEL.exe is a tool available as part of the Windows NT Resource Kit utilities that can be used to delete registry entries from the command line: 1. Copy the following text into a .bat file (for example, c:\dfremove.bat) and run the batch file on machines on which you want to remove the RDS components. REM Batch file to remove RDS components REM Make sure that REGDEL.exe from the Resource Kit is in your PATH REGDEL "SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\AdvancedDa taFactory" REGDEL "SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\RDSServer.D ataFactory" REGDEL "SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\VbBusObj.V bBusObjCls" Echo RDS Keys Removed 2. Execute or run the batch file on the web server. References Microsoft Security Bulletin MS98-004 Unauthorized ODBC Data Access with RDS and IIS http://www.microsoft.com/TechNet/security/bulletin/ms98-004.asp Microsoft Knowledge Base Article Q184375 Security Implications of RDS 1.5, IIS 3.0 or 4.0, and ODBC http://support.microsoft.com/support/kb/articles/q184/3/75.asp Microsoft Security Bulletin MS99-025 Re-Release: Unauthorized Access to IIS Servers through ODBC Data Access with RDS http://www.microsoft.com/TechNet/security/bulletin/ms99-025.asp 318 Internet Explorer msradio buffer overflow (HTTP_MSRadio_Overflow) CIAC Information Bulletin J-054 Unauthorized Access to IIS Servers through ODBC Data Access with RDS http://www.ciac.org/ciac/bulletins/j-054.shtml Microsoft Security Bulletin MS99-025 FAQ Microsoft Security Bulletin (MS99-025): Frequently Asked Questions http://www.microsoft.com/technet/security/bulletin/fq99-025.asp CERT Incident Note IN-1999-08 Attacks against IIS web servers involving MDAC http://www.cert.org/incident_notes/IN-99-08.html Internet Security Systems Security Alert #32 Vulnerabilities in Microsoft Remote Data Service http://xforce.iss.net/alerts/advise32.php Microsoft Universal Data Access Download page MDAC 2.5 RTM http://www.microsoft.com/data/download.htm ISS X-Force IIS unauthorized ODBC data access with RDS http://xforce.iss.net/static/1212.php CVE CVE-1999-1011 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-1011 Internet Explorer msradio buffer overflow (HTTP_MSRadio_Overflow) About this signature or vulnerability This signature detects a vnd.ms.radio URL containing more than 300 characters, which could indicate an attempt by an attacker to overflow a buffer in the MSDXM.OCX file. Default risk level High Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected Microsoft Internet Explorer: 5.0 Type Unauthorized Access Attempt Vulnerability description Microsoft Internet Explorer 5.x is vulnerable to a buffer overflow in the file MSDXM.OCX. By sending a string of 360 or more characters to the local call vnd.ms.radio:\\, an attacker can overflow the buffer and execute arbitrary code on the system. How to remove this vulnerability No remedy available as of September 2000. 319 NCSA httpd allows remote users to execute commands (HTTP_NCSA_Buffer_Overflow) References BugTraq Mailing List, Sun Dec 05 1999 02:32:02 new IE5 remote exploit http://www.securityfocus.com/archive/1/37444 ISS X-Force Internet Explorer msradio buffer overflow http://xforce.iss.net/static/3695.php CVE CVE-1999-0989 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0989 NCSA httpd allows remote users to execute commands (HTTP_NCSA_Buffer_Overflow) False positives RealSecure Network Sensor: A false positive is possible for URLs exceeding 256 characters. RealSecure displays the first 80 characters of the URL. Examine the URL carefully: an abundance of unprintable characters is indicative of a buffer overflow attack; if the characters are primarily ASCII, then this event is most likely a false positive. RealSecure Server Sensor: A false positive is possible for URLs exceeding 256 characters. RealSecure displays the first 80 characters of the URL. Examine the URL carefully: if there are lots of unprintable characters, then this is likely to be a buffer overflow attack; if the characters are primarily ASCII, then it is most likely a false positive. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected NCSA Servers: Old Versions Type Unauthorized Access Attempt Vulnerability description A vulnerability in the NCSA HTTP server version 1.3 could allow a remote attacker to send a specially constructed request to execute arbitrary code on the server. An attacker could use this to gain root-level access. Exploit information for various platforms has been made widely available for this vulnerability. How to remove this vulnerability Switch to a supported server platform, such as Apache. — OR — Upgrade to the last stable release of the NCSA server or apply patches to correct this problem. (The NCSA server is otherwise no longer supported.) References CERT Advisory CA-1995-04 NCSA HTTP Daemon for UNIX Vulnerability http://www.cert.org/advisories/CA-1995-04.html 320 Netscape Enterprise Server allows remote directory listing (HTTP_Netscape_List_Directories) CIAC Information Bulletin F-11 Unix NCSA httpd Vulnerability http://ciac.llnl.gov/ciac/bulletins/f-11.shtml ISS X-Force NCSA httpd allows remote users to execute commands http://xforce.iss.net/static/517.php CVE CVE-1999-0267 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0267 Netscape Enterprise Server allows remote directory listing (HTTP_Netscape_List_Directories) False positives RealSecure Network Sensor: A false positive is possible for legitimate HTTP INDEX requests. Though there are legitimate reasons for HTTP INDEX requests, such a request can be used by an attacker to gain access to sensitive information on Netscape Enterprise Web servers. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected Netscape Enterprise Server: 3.0, Netscape Enterprise Server: 4.0 Type Unauthorized Access Attempt Vulnerability description Netscape Enterprise Server versions 3.0 and 4.0 with the Web Publishing feature enabled could allow a remote attacker to obtain a directory listing of the server. A remote attacker can connect to the server using telnet and send an "INDEX / HTTP/1.0" request to cause the server to display the directory listing. An attacker can use this vulnerability to gain access to sensitive information. How to remove this vulnerability No remedy available as of February 2001. As a workaround, disable Web Publishing or disable INDEX requests. References S.A.F.E.R. Security Bulletin 010124.EXP.1.11 Netscape Enterprise Server - INDEX request problem http://www.safermag.com/advisories/0013.html ISS X-Force Netscape Enterprise Server allows remote directory listing http://xforce.iss.net/static/5997.php CVE CAN-2001-0250 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0250 321 Netscape Enterprise Server REVLOG denial of service (HTTP_Netscape_Revlog) Netscape Enterprise Server can be tricked into listing Web directories (HTTP_Netscape_PageServices) Default risk level Low Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Netscape Enterprise Server Type Pre-attack Probe Vulnerability description Some versions of Netscape Enterprise Server can be tricked into revealing file listings for directories that otherwise could not be viewed due to the existence of an index.html file. A remote attacker could view file listings not intended for public access by requesting a URL that includes the string "?PageServices." File listings could be useful to an attacker in planning future attacks. How to remove this vulnerability Disable directory browsing on affected servers. — AND — Upgrade to the latest version of iPlanet Web Server, Enterprise Edition (6.0 or later), available from the iPlanet Web site. See References. References BugTraq Mailing List, Sun Aug 16 1998 19:38:41 Fw: [NTSEC] Netscape Server Security Hole http://www.securityfocus.com/archive/1/10341 iPlanet Web site Downloads http://www.iplanet.com/downloads/download/index.html ISS X-Force Netscape Enterprise Server can be tricked into listing Web directories http://xforce.iss.net/static/1810.php CVE CVE-1999-0269 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0269 Netscape Enterprise Server REVLOG denial of service (HTTP_Netscape_Revlog) About this signature or vulnerability This signature detects an HTTP 'REVLOG' request, which may indicate an attacker's attempt to crash or otherwise disrupt the service of a Netscape Enterprise Web server. Default risk level Medium 322 Netscape servers could reveal source code to some scripts (HTTP_Netscape_SpaceView) Sensors that have this signature RealSecure Network Sensor: XPU 3.3 Systems affected Netscape Enterprise Server Type Suspicious Activity Vulnerability description Netscape Enterprise Server version 3.x with Web Publishing enabled is vulnerable to a denial of service attack. A remote attacker can connect to the server and submit a 'REVLOG / HTTP/1.0' request to cause the server to crash. How to remove this vulnerability No remedy available as of August 2001. As a workaround, disable Web Publishing or REVLOG requests, as listed in S.A.F.E.R. Security Bulletin 010125.DOS.1.5. References S.A.F.E.R. Security Bulletin 010125.DOS.1.5 Netscape Enterprise Server - REVLOG request problem http://www.safermag.com/advisories/0014.html ISS X-Force Netscape Enterprise Server REVLOG denial of service http://xforce.iss.net/static/6003.php CVE CAN-2001-0251 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0251 Netscape servers could reveal source code to some scripts (HTTP_Netscape_SpaceView) False positives RealSecure Network Sensor: As the regular expression (" $") is written, it detects any URL that has a preceding space character before termination. So a URL with an arbitrary number of spaces >1 would also trigger this event. Testing has not revealed if this is a valid exploit of this particular problem. Trailing space(s) on an URL is an anomalous event regardless and the possible false positive is acceptable. RealSecure Server Sensor: As the regular expression (" $") is written, it detects any URL that has a preceding space character before termination. So a URL with an arbitrary number of spaces >1 would also trigger this event. Testing has not revealed if this is a valid exploit of this particular problem. Trailing space(s) on an URL is an anomalous event regardless and the possible false positive is acceptable. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Netscape FastTrack, Netscape Enterprise Server 323 Nimda worm propagation (HTTP_Nimda_Riched20dll) Type Pre-attack Probe Vulnerability description A vulnerability in Netscape Enterprise and FastTrack servers could allow a remote attacker to view the source to scripts that are not normally accessible. A remote attacker can append a space character in the form of "%20" to the end of a GET request to cause the server to mistakenly return the source code to the script instead of executing the script. This could reveal sensitive information about the server or backend's setup. How to remove this vulnerability Apply the 186244-readme patch, as listed in Allaire Security Bulletin (ASB99-06). See References. References Allaire Security Bulletin ASB99-06 Netscape Servers for Win NT Exposure of Source Code with "%20" http://www.allaire.com/handlers/index.cfm?ID=10967 Netscape Communications, Inc. Web site PATCH #P186244 Release Notes http://help.netscape.com/products/server/enterprise/P186244-readme.html ISS X-Force Netscape servers could reveal source code to some scripts http://xforce.iss.net/static/2206.php CVE CAN-1999-0286 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0286 Nimda worm propagation (HTTP_Nimda_Riched20dll) About this signature or vulnerability This signature detects when a file named "riched20.dll" is written to a Windows file server. This file is created by the Nimda worm, and it may also be created by other malicious worms or viruses. False positives RealSecure Server Sensor: A false positive is possible if users copy large directories to servers and those directories contain a file named riched20.dll. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Windows NT, Windows 95, Windows 98, Microsoft IIS: 4.0, Windows 2000, Windows ME, Microsoft IIS: 5.0 Type Suspicious Activity Vulnerability description The Nimda worm is similar in functionality to the Code Red worm and its derivatives. The Nimda worm attempts to identify vulnerable Microsoft IIS servers by using several Unicode Web Folder Traversal vulnerability attack strings to probe for vulnerable IIS 324 Nimda worm propagation (HTTP_Nimda_Riched20dll) systems and deface them. Nimda can infect any Windows system and then propogate by emailing copies of itself to individuals in MAPI (Messaging Application Programming Interface) address books, or by identifying and infecting vulnerable IIS servers. Nimda takes advantage of standard email distribution techniques to broaden the range of target hosts. Instead of only attacking Web servers with Web server vulnerabilities, Nimda is designed to also propagate using spoofed email. The email is spoofed to appear to have been sent by trusted sources. Nimda relies on extensive local propagation once a system is infected. It replaces '.dll', '.eml', '.nws' files on all shared drives. It also appends itself to all '.htm', '.html', and '.asp' files on the infected system. This also allows the worm to spread to remote users when they access Web pages on infected servers. For additional information regarding the "Nimda" worm, refer to Internet Security Systems Security Alert #97. See References. How to remove this vulnerability For Microsoft IIS versions 4.0 and 5.0: Apply the latest IIS cumulative security patch to prevent Web servers from being compromised by the Nimda worm, as listed in Microsoft Security Bulletin MS01-044. See References. For Microsoft Internet Explorer versions 5.01 and 5.5: To prevent the automatic execution of email attachments due to an Incorrect MIME headers, apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS01-020. See References. Additional information on recovering from a system compromise is available from the CERT Coordination Center Web site. See References. References Internet Security Systems Security Alert #97 Aggressive Propagation of Nimda Worm http://xforce.iss.net/alerts/advise97.php CERT Advisory CA-2001-26 Nimda Worm http://www.cert.org/advisories/CA-2001-26.html Microsoft Security Bulletin MS01-044 15 August 2001 Cumulative Patch for IIS http://www.microsoft.com/technet/security/bulletin/MS01-044.asp Microsoft Security Bulletin MS01-020 Incorrect MIME Header Can Cause IE to Execute E-mail Attachment http://www.microsoft.com/technet/security/bulletin/MS01-020.asp F-Secure Computer Virus Information Page Nimda http://www.f-secure.com/v-descs/nimda.shtml CERT Coordination Center Steps for Recovering from a UNIX or NT System Compromise http://www.cert.org/tech_tips/win-UNIX-system_compromise.html 325 Novell Convert.bas Web server script (HTTP_Novell_Convert) BugTraq Mailing List, Tue Sep 18 2001 18:49:43 Nimda Worm http://www.securityfocus.com/archive/1/215177 CIAC Information Bulletin L-144 The W32.nimda Worm http://www.ciac.org/ciac/bulletins/l-144.shtml Microsoft TechNet Information on the "Nimda" Worm http://www.microsoft.com/technet/security/topics/Nimda.asp CIAC Information Bulletin L-132 Microsoft Cumulative Patch for IIS http://www.ciac.org/ciac/bulletins/l-132.shtml ISS X-Force Nimda worm propagation http://xforce.iss.net/static/7130.php Novell Convert.bas Web server script (HTTP_Novell_Convert) About this signature or vulnerability This signature detects an attack on the convert.bas cgi-bin program included as part of some versions of Novell's HTTP server. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Novell Web Server: 1.0, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The convert.bas program is included as part of the default installation of some versions of the Novell HTTP server. A remote attacker can access the convert.bas program by using specially formatted arguments to read any file on the Web server that is readable by the ID of the Web server process. An attacker can use this vulnerability to gain information that could be useful in performing further attacks. How to remove this vulnerability Apply the web002.exe patch, available from the Novell Web site. See References. — OR — Remove the convert.bas program from the Web server. References Firewalls Mailing List, Wed, 3 Jul 1996 14:50:06 -0700 (PDT) *** SECURITY ALERT *** http://www.netsys.com/firewalls/firewalls-9607/0102.html 326 Novell CGI script files.pl could allow remote file viewing (HTTP_Novell_Files) Novell Web site WEB002.EXE: Web Server Security http://support.novell.com/cgi-bin/search/tidfinder.cgi?2911895 SecurityWire.com Web site Novell HTTPd Server has default GI that can be breached http://www.securitywire.com/hack/novell/phunc_cgi.novell BugTraq Mailing List, Wed Jul 03 1996 18:02:35 BoS: *** SECURITY ALERT *** (fwd) http://www.securityfocus.com/archive/1/4875 ISS X-Force Novell Convert.bas Web server script http://xforce.iss.net/static/339.php CVE CVE-1999-0175 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0175 Novell CGI script files.pl could allow remote file viewing (HTTP_Novell_Files) About this signature or vulnerability This signature detects HTTP GET requests for the files.pl PERL script distributed with Novell WebServer Examples Toolkit v2. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2 Systems affected Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description A vulnerability in the files.pl script distributed with Novell WebServer Examples Toolkit v2 could allow a remote attacker to view the contents of any file or directory on vulnerable servers. The attacker would be limited to viewing files accessible to the user owning the server process. How to remove this vulnerability Remove the 'files.pl' script from any production or sensitive servers on your network. It is a good practice to always remove sample scripts from the CGI-BIN directory of your Web server before putting it into production. References WWW Security FAQ Are there any known security problems with Novell WebServer? http://www.w3.org/Security/Faq/wwwsf8.html#Q87 327 Nph-test-cgi program remote users can list files (HTTP_NphTestCgi) WWW Security FAQ What CGI scripts are known to contain security holes? http://www.roxanne.org/faqs/www-secure/wwwsf4.html#Q35 ISS X-Force Novell CGI script files.pl could allow remote file viewing http://xforce.iss.net/static/2054.php Nph-test-cgi program remote users can list files (HTTP_NphTestCgi) About this signature or vulnerability This signature detects an attack on the cgi-bin nph-test-cgi script. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected NCSA Servers: Old Versions, Apache Web Server: Old Versions, Common Gateway Interface (CGI) Type Pre-attack Probe Vulnerability description The nph-test-cgi program allows a remote attacker to list the contents of any readable directory on a Web server. This allows a remote attacker to inspect the victim's system for other likely vulnerabilities or targets. By default, the nph-test-cgi program is installed with Apache Web servers up to and including version 1.0.5. It is also installed with some versions of the NCSA Web server. This vulnerability is also commonly present in the test-cgi program. How to remove this vulnerability Remove the nph-test-cgi script. The nph-test-cgi script is included in Web server packages as a code sample and is not required for the cgi-bin directory. — OR — Upgrade to the latest available version of the Apache Web server as listed in CERT Advisory CA-1997-07. See References. Version 1.1.3 and later does not include the nphtest-cgi script in a default installation. References @stake, Inc./L0pht Security Advisory 04/96 test-cgi vulnerability in certain setups http://www.atstake.com/research/advisories/1996/test-cgi-vulnerability.txt CERT Advisory CA-1997-07 Vulnerability in the httpd nph-test-cgi script http://www.cert.org/advisories/CA-1997-07.html 328 Netscape Enterprise and Fasttrack authentication buffer overflow (HTTP_NS_Admin_Overflow) ISS X-Force Nph-test-cgi program remote users can list files http://xforce.iss.net/static/289.php CVE CVE-1999-0045 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0045 Netscape Enterprise and Fasttrack authentication buffer overflow (HTTP_NS_Admin_Overflow) About this signature or vulnerability This signature detects a long username or password directed at the HTTP Basic Authentication port of the Netscape Enterprise Server or Netscape Fasttrack Server. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected Netscape Enterprise Server: 3.51, Netscape Enterprise Server: 3.6, Netscape Enterprise Server: 3.6 SP2, Netscape FastTrack: 3.01 Type Unauthorized Access Attempt Vulnerability description Netscape Enterprise Server and Netscape FastTrack Server are vulnerable to a buffer overflow in the HTTP Basic Authentication portion of the server. This vulnerability affects systems running Administration Server with password protected areas that rely on Basic Authentication. When accessing a password protected area of the Administration or Web server, an attacker can cause the server to crash with an access violation error by sending a username or password that is longer than 508 characters. As a result, an attacker could execute arbitrary code as SYSTEM on Windows NT, or as root on Unix. Attackers can use these privileges to gain full access to the server. How to remove this vulnerability Upgrade to the latest version of iPlanet Web Server (4.0sp2 or later), available from the iPlanet Downloads Web site. See References. Netscape has stated that FastTrack will not be patched. Although Netscape released service pack 3 for Enterprise Server 3.6, which fixes the vulnerability in the Web server, the Administration Server remains vulnerable. If you are unable to upgrade, block the Administration Server port at the firewall to prevent outside attacks. References Internet Security Systems Security Alert #39 Buffer Overflow in Netscape Enterprise and FastTrack Authentication Procedure http://xforce.iss.net/alerts/advise39.php 329 Win32 Web servers allow access to files requested using the 8.3 format (HTTP_NT8.3_Filename) iPlanet Downloads Web site iPlanet Download Page http://www.iplanet.com/download_index/downloads_index_9_0.html ISS X-Force Netscape Enterprise and Fasttrack authentication buffer overflow http://xforce.iss.net/static/3586.php CVE CVE-1999-0853 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0853 Win32 Web servers allow access to files requested using the 8.3 format (HTTP_NT8.3_Filename) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Microsoft IIS: 4.0, Microsoft Personal Web Server: 4.0, Netscape Enterprise Server Type Unauthorized Access Attempt Vulnerability description All Win32 Microsoft operating systems can associate both a short and a long file name with a file. For backward compatibility with DOS, the short name is restricted to a length of 8 characters and an extension of 3 characters ("8.3-compliant" format). The long name is not restricted to the 8.3-compliant format, but is restricted to a total length of 255 characters. Windows NT and Windows 95 Web servers create lists of restricted file names for restricted files on the server. However, because these lists do not contain any short file names of the files, restricted files can still be accessed through their short file name. In some cases, when a URL is requested using the short file name, the Web server can apply different configuration settings to the request (including SSL encryption requirements, IP address restriction requirements, and PICS ratings). This could enable an attacker to gain access to unauthorized files. How to remove this vulnerability Apply the latest Windows NT 4.0 Service Pack (SP4 or later), available from the Windows NT Service Packs Web page. See References. — OR — Disable the 8.3 file name creation in the Windows NT registry. Choosing to disable 8.3 file name creation increases both security and performance on the Web server, but it can cause problems when running 16-bit programs. To disable 8.3 file name creation, enable the NtfsDisable8dot3NameCreation registry entry: 330 Win32 Web servers allow access to files requested using the 8.3 format (HTTP_NT8.3_Filename) CAUTION: Use Registry Editor at your own risk. Any change using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems caused by the use of Registry Editor can be solved. 1. Verify that no 16-bit applications are used on the Web site. If you require 16-bit applications, you may still apply the fix if all of the paths and files referenced meet the 8.3 naming convention. 2. Using Registry Editor, find the HKLM\System\CurrentControlSet\Control\FileSystem registry key. 3. Select Edit -> New -> DWORD Value. A new registry entry is created. 4. Name the new registry entry "NtfsDisable8dot3NameCreation" . The value should be set to 1. References Microsoft TechNet Microsoft Internet Information Server 4.0 Security Checklist http://www.microsoft.com/TechNet/security/iischk.asp#6 Microsoft Knowledge Base Article Q179148 Settings May Not Be Applied with URL with Short Filename http://support.microsoft.com/support/kb/articles/q179/1/48.asp NTBugtraq Mailing List, Thu, 8 Jan 1998 19:04:23 -0700 Nifty Security hole on Several NT Based Web Servers http://www.ntbugtraq.com/ default.asp?pid=36&sid=1&A2=ind9801&L=ntbugtraq&F=P&S=&P=1298 CERT Advisory CA-1998-04 Microsoft Windows-based Web Servers unauthorized access - long file names http://www.cert.org/advisories/CA-98.04.Win32.WebServers.html Bugtraq Mailing List, Sat Aug 14 1999 13:58:38 Win32 File Naming (again) http://www.securityfocus.com/archive/1/24207 Microsoft Product Support Services Windows NT Service Packs http://support.microsoft.com/support/ntserver/Content/ServicePacks/ CIAC Information Bulletin I-025a Windows NT based Web Servers File Access Vulnerability http://www.ciac.org/ciac/bulletins/i-025a.shtml ISS X-Force Win32 Web servers allow access to files requested using the 8.3 format http://xforce.iss.net/static/709.php CVE CVE-1999-0012 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0012 331 Oracle Application Server shared library (ndwfn4.so) buffer overflow (HTTP_Oracle_Appserver_Overflow) Oracle Application Server shared library (ndwfn4.so) buffer overflow (HTTP_Oracle_Appserver_Overflow) About this signature or vulnerability This signature detects an HTTP GET request greater than 2000 characters preceded by "/ jsp/". This may indicate an attacker's attempt to cause a buffer overflow in the Oracle Application Server (OAS) shared library file "$ORAHOME/ows/4.0/lib/ndwfn4.so." Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.2 Systems affected iPlanet Web Server: 4.x, Oracle Application Server: 4.0.8.2 Type Unauthorized Access Attempt Vulnerability description Oracle Application Server (OAS) version 4.0.8.2 is vulnerable to a denial of service attack caused by a buffer overflow in the shared library file "$ORAHOME/ows/4.0/lib/ ndwfn4.so." By sending a GET request containing a string of 2050 characters or more preceded by "/jsp/," an attacker can overflow a buffer and execute arbitrary code on the server. This vulnerability also affects iPlanet Web Server versions 4.0 and 4.1, which use the shared library file when configured as an external Web listener for OAS. How to remove this vulnerability Upgrade to the latest version of iPlanet Web Server (4.1sp7 or later), available from the iPlanet Web site. See References. References S.A.F.E.R. Security Bulletin 0016 Oracle Application Server shared library buffer overflow http://www.safermag.com/advisories/0016.html CERT Vulnerability Note VU#276767 iPlanet web servers expose sensitive data via buffer overflow http://www.kb.cert.org/vuls/id/276767 @stake, Inc. Security Advisory A041601-1 iPlanet Web Server Enterprise Edition 4.0, 4.1 Response Header Overflow http://www.atstake.com/research/advisories/2001/a041601-1.txt iPlanet Web site Important iPlanet Web Server 4.x Product Alert: Recommend Immediate Patch/Upgrade http://www.iplanet.com/products/iplanet_web_enterprise/iwsalert4.16.html BugTraq Mailing List, Tue Apr 17 2001 12:42:47 iPlanet Web Server 4.x Product Alert http://www.securityfocus.com/archive/1/177220 ISS X-Force Oracle Application Server shared library (ndwfn4.so) buffer overflow http://xforce.iss.net/static/6334.php 332 Order Form shopping cart misconfiguration exposes order information (HTTP_Orderform) CVE CAN-2001-0327 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0327 Order Form shopping cart misconfiguration exposes order information (HTTP_Orderform) About this signature or vulnerability This signature detects an HTTP GET request for the Merchant Order Form order log file. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected Merchant Order Form Type Unauthorized Access Attempt Vulnerability description The Merchant Order Form shopping cart system could potentially be misconfigured in such a way that sensitive order information is exposed to remote attackers. How to remove this vulnerability Reinstall the Merchant Order Form Shopping Cart application, following the installation instructions carefully. To prevent unauthorized remote access to sensitive Merchant Order Form Shopping Cart files and directories, ensure that appropriate permissions have been set. References BugTraq Mailing List, Tue Apr 20 1999 13:34:57 Re: Shopping Carts exposing CC data http://www.securityfocus.com/archive/1/13363 The Rainbow Garden Web site Merchant Order Form v1.4 - WebWare http://www.io.com/~rga/scripts/cgiorder.html ISS X-Force Order Form shopping cart misconfiguration exposes order information http://xforce.iss.net/static/3860.php CVE CAN-1999-0605 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0605 333 PDGSoft’s Shopping Cart misconfiguration exposes config and order files (HTTP_PDGSoft) PDGSoft’s Shopping Cart misconfiguration exposes config and order files (HTTP_PDGSoft) About this signature or vulnerability This signature detects an HTTP GET request for the PDGSoft Shopping Cart order log file or the configuration file. False negatives RealSecure Network Sensor: RealSecure detects a misconfiguration of the PDGSoft Shopping Cart application only when particular exposed files are installed in a default directory, the "PDG_Cart" directory. A false negative is possible if the exposed files are installed in a directory other than "PDG_Cart". RealSecure Server Sensor: RealSecure detects a misconfiguration of the PDGSoft Shopping Cart application only when particular exposed files are installed in a default directory, the "PDG_Cart" directory. A false negative is possible if the exposed files are installed in a directory other than "PDG_Cart". Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected PDGSoft Shopping Cart Type Unauthorized Access Attempt Vulnerability description PDGSoft's Shopping Cart Web-based shopping systems could be potentially misconfigured by the site's administrator. This misconfiguration could expose the order log file and the configuration file, which includes the system's admin username and password in plaintext. How to remove this vulnerability Reinstall the PDGSoft Shopping Cart application, following the installation instructions carefully. To prevent unauthorized remote access to sensitive PDGSoft Shopping Cart files and directories, ensure that appropriate permissions have been set. References BugTraq Mailing List, Tue Apr 20 1999 13:34:57 Re: Shopping Carts exposing CC data http://www.securityfocus.com/archive/1/13363 Ecommerce Guide Web site PDG Software's Response to Security Threat http://ecommerce.internet.com/outlook/article/0,1467,7761_239511,00.html PDG Software, Inc. Web site PDG Software Moves Quickly to Ensure Customers' Security http://www.pdgsoft.com/Security/security.html ISS X-Force PDGSoft’s Shopping Cart misconfiguration exposes config and order files http://xforce.iss.net/static/3857.php 334 SGI pfdispaly.cgi script allows remote file viewing with server privileges (HTTP_Pfdisplay_Read) CVE CVE-1999-0608 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0608 IRIX pfdispaly.cgi program was not fixed by a previous SGI patch (HTTP_Pfdisplay_Execute) False positives RealSecure Network Sensor: A false positive is possible for legitimate uses of pfdispaly.cgi. RealSecure Server Sensor: A false positive is possible for legitimate uses of pfdisplay.cgi. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected IRIX: 6.2, IRIX: 6.3, IRIX: 6.4, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The IRIX Performer API Search Tool (pdfdispaly.cgi) is a Web-based search tool that assists in the searching of man pages, documents, example code, and special items known as classes, methods, tokens, and samples. A vulnerability in the pfdispaly.cgi program could allow a remote user to run any file on the system with 'nobody' privileges. This vulnerability was not corrected in the SGI pfdispaly patch 3018. How to remove this vulnerability No remedy available as of January 2001. As a workaround, change the permissions of the pfdispaly.cgi program to prevent non-root users from executing the program. References BugTraq Mailing List, Tue Apr 07 1998 04:16:01 perfomer_tools again http://www.securityfocus.com/archive/1/8935 ISS X-Force IRIX pfdispaly.cgi program was not fixed by a previous SGI patch http://xforce.iss.net/static/1434.php SGI pfdispaly.cgi script allows remote file viewing with server privileges (HTTP_Pfdisplay_Read) False positives RealSecure Network Sensor: A false positive is possible for normal, legitimate uses of pfdisplay.cgi RealSecure Server Sensor: A false positive is possible for normal, legitimate uses of pfdisplay.cgi Default risk level Medium 335 Phone book CGI phf allows remote execution of arbitrary commands (HTTP_PHF) Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected IRIX: 6.2, IRIX: 6.3, IRIX: 6.4, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The IRIS Performer API Search Tool is a Web-based search tool that assists in the searching of man pages, documents, example code, and special items known as classes, methods, tokens, and samples. A vulnerability in the pfdispaly.cgi program could allow remote users to view any file on the system with 'nobody' privileges. How to remove this vulnerability For SGI IRIX 6.2, 6.3, or 6.4 systems, apply patch 3018, as listed in Silicon Graphics Inc. Security Advisory 19980401-01-P3018. See References. References SGI Security Advisory 19980401-01-P3018 Performer API Search Tool 2.2 pfdispaly.cgi Vulnerability ftp://patches.sgi.com/support/free/security/advisories/19980401-01-P3018 BugTraq Mailing List, Mon Mar 16 1998 23:06:48 IRIX performer_tools bug http://www.securityfocus.com/archive/1/8783 CIAC Information Bulletin I-041 Performer API Search Tool 2.2 pfdispaly.cgi Vulnerability http://ciac.llnl.gov/ciac/bulletins/i-041.shtml ISS X-Force SGI pfdispaly.cgi script allows remote file viewing with server privileges http://xforce.iss.net/static/810.php CVE CVE-1999-0270 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0270 Phone book CGI phf allows remote execution of arbitrary commands (HTTP_PHF) About this signature or vulnerability This signature detects HTTP GET requests for the cgi-bin script "phf," which may indicate attempts by an attacker to execute arbitrary commands on a Web server. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected NCSA Servers: Old Versions, Apache Web Server: Old Versions, Common Gateway Interface (CGI) 336 PHP/FI php.cgi script contains a remotely exploitable buffer overflow (HTTP_PHP_Overflow) Type Unauthorized Access Attempt Vulnerability description A vulnerability exists in the phf phone book that is pre-installed with several older versions of NCSA and Apache Web server packages. The pre-installed cgi-bin script "phf" could allow a remote attacker to execute arbitrary commands on a Web server. Exploit information for this vulnerability is widespread and many programs exist to actively probe entire networks for this vulnerability. An attacker could use the phone book program to deface a Web page. This vulnerability could also be used by an attacker to gather information for further attacks or to gain root or administrator access to the target system. How to remove this vulnerability No remedy available as of April 2001. As a workaround, remove the phf program from the cgi-bin directory (it is not necessary for normal operation of your Web server). If your situation requires the use of phf, permit only those characters that you are certain you can handle correctly. Do not filter out bad characters. References CERT Advisory CA-1996-06 Vulnerability in NCSA/Apache CGI example code http://www.cert.org/advisories/CA-1996-06.html IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1996:002.1 Some C-language based Common Gateway Interface programs that call a shell to execute other programs can be tricked into executing any arbitrary command http://www-1.ibm.com/services/brs/brspwhub.nsf/advisories IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1996:002.2 Update of ERS-SVA-E01-1996:002.1 http://www-1.ibm.com/services/brs/brspwhub.nsf/advisories CERT Vulnerability Note VU#20276 'phf' CGI Script fails to Guard Against newline Characters https://www.kb.cert.org/vuls/id/20276 ISS X-Force Phone book CGI phf allows remote execution of arbitrary commands http://xforce.iss.net/static/148.php CVE CVE-1999-0067 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0067 PHP/FI php.cgi script contains a remotely exploitable buffer overflow (HTTP_PHP_Overflow) About this signature or vulnerability This signature detects an attack on the PHP cgi-bin program. 337 PHP remote users can read files (HTTP_PHP_Read) Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected PHP, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The php CGI program php.cgi (part of the PHP/FI package developed by Rasmus Lerdorf) is vulnerable to a buffer overflow. A remote attacker can overflow the buffer and execute arbitrary code on the system under the UID of the user owning the httpd process, usually "nobody." An attacker could exploit this vulnerability to change to contents of a Web page or gain root or administrator access to the system. How to remove this vulnerability Disable access to the php.cgi executable or move the PHP directory structure outside the Web tree. — AND — Upgrade to the latest version of PHP (4.0.4 or later), available from the PHP Web site. See References. References PHP Hypertext Preprocessor Web site PHP Information http://www.php.net Network Associates, Inc. COVERT Labs Security Advisory #12 PHP/FI command line buffer overflow http://www.pgp.com/research/covert/advisories/012.asp ISS X-Force PHP/FI php.cgi script contains a remotely exploitable buffer overflow http://xforce.iss.net/static/293.php CVE CVE-1999-0058 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0058 PHP remote users can read files (HTTP_PHP_Read) About this signature or vulnerability This signature detects an attack on the PHP cgi-bin program. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 338 PHP-Nuke unauthorized administrator access (HTTP_PHPNuke_Admin_Access) Systems affected PHP, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The php CGI program php.cgi is part of the PHP/FI package developed by Rasmus Lerdorf. An attacker can access the php.cgi program with specially formatted arguments to obtain directory listings of directories on the Web server or read the contents of any file accessible to the user who owns the server process. This information could be used by an attacker in performing further attacks against the system or network. How to remove this vulnerability Disable access to the php.cgi executable or move the PHP directory structure outside the Web tree. — AND — Upgrade to the latest version of PHP (4.0.4 or later), available from the PHP Web site. See References. References PHP Hypertext Preprocessor Web site PHP Information http://www.php.net ISS X-Force PHP remote users can read files http://xforce.iss.net/static/292.php PHP-Nuke unauthorized administrator access (HTTP_PHPNuke_Admin_Access) About this signature or vulnerability This signature detects a specially-crafted HTTP GET request for the PHP-Nuke admin.php3 file. This GET request could indicate an attempt by an attacker to bypass the PHP-Nuke administrator password to gain unauthorized administrative access to the program. False positives RealSecure Network Sensor: A false positive is possible for installations of PHP-Nuke that have not implemented a password for the administrator account. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected PHP-Nuke: 2.5 Type Unauthorized Access Attempt Vulnerability description PHP-Nuke is an open-source program for creating and managing news-based Web sites. PHP-Nuke versions 2.5 and earlier could allow a remote attacker to gain administrator 339 PHP-Nuke could allow attackers to redirect ad banner URL links (HTTP_PHPNuke_URL_Redirect) rights to the program. An attacker could submit a specially-crafted URL that would cause the program to behave as though a valid administrator password has been entered. An attacker could exploit administrator rights to edit users, articles, banners, or other related data. How to remove this vulnerability Upgrade to the latest version of PHP-Nuke (3.0 or later), available from the PHP-Nuke Web site. See References. References SecuriTeam.com Mailing List 20 August 2000 Security holes in PHP-Nuke give administrative access to attackers http://www.securiteam.com/securitynews/5AP0L002AG.html PHP-Nuke Web site PHP-Nuke http://phpnuke.org/ ISS X-Force PHP-Nuke unauthorized administrator access http://xforce.iss.net/static/5108.php CVE CVE-2000-0745 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0745 PHP-Nuke could allow attackers to redirect ad banner URL links (HTTP_PHPNuke_URL_Redirect) About this signature or vulnerability This signature detects an attacker's attempt to change the destination URL of an ad banner on a Web site that uses the PHP-Nuke program's banners.php file. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 3.2 Systems affected PHP-Nuke: 4.4 and earlier Type Suspicious Activity Vulnerability description PHP-Nuke is an open-source program for creating and managing news-based Web sites. PHP-Nuke versions 4.4 and earlier could allow a remote attacker to alter the destination URL when a visitor clicks an ad banner on a PHP-Nuke Web site. A remote attacker could submit a query string within a URL request to an affected PHP-Nuke Web site to alter the URL destination for a banner ad. How to remove this vulnerability Upgrade to the latest version of PHP-Nuke (4.4.1 or later), available from the PHP-Nuke Web site. See References. 340 HTTP POST request to a script or resource (HTTP_Post) References BugTraq Mailing List, Mon Apr 02 2001 16:18:53 Php-nuke exploit… http://www.securityfocus.com/archive/1/173720 BugTraq Mailing List, Wed Apr 04 2001 12:09:15 Re: Php-nuke exploit… http://www.securityfocus.com/archive/1/174065 PHP-Nuke Web site PHP-Nuke Download Section http://www.phpnuke.org/download.php?dcategory=PHP-Nuke&sortby= PHP-Nuke Web site PHP-Nuke Download Section http://phpnuke.org/download.php?dcategory=Fixes ISS X-Force PHP-Nuke could allow attackers to redirect ad banner URL links http://xforce.iss.net/static/6342.php CVE CVE-2001-0383 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0383 HTTP POST request to a script or resource (HTTP_Post) About this signature or vulnerability This signature detects that a computer on your network has submitted an HTTP POST request to a Web server. You can configure RealSecure to terminate HTTP POST connections by using the RSKILL response on HTTP POST requests. You can also configure RealSecure to only monitor and record this traffic, instead of stopping it completely. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected HTTP Type Protocol Signature Vulnerability description An HTTP POST request is a packet of information that a Web browser is attempting to send to a Web server. People that browse the Web create these requests when filling out a form on a Web site that uses HTTP POST. This information can be sensitive in nature, such as an employee's name, telephone number, or, in some cases, a credit card number. HTTP POST requests also send information that the user does not see, like the computer's IP address or other information about the user's computer. How to remove this vulnerability You can prohibit HTTP POST requests in many ways, such as configuring your firewall to disallow HTTP POST requests. 341 QuikStore Shopping Cart misconfiguration exposes the config file (HTTP_QuikStore) References ISS X-Force HTTP POST request to a script or resource http://xforce.iss.net/static/3172.php QuikStore Shopping Cart misconfiguration exposes the config file (HTTP_QuikStore) About this signature or vulnerability This signature detects an HTTP GET request for the QuikStore configuration file. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected I-Soft QuikStore Type Unauthorized Access Attempt Vulnerability description I-Soft's QuikStore shopping cart system could potentially be misconfigured by an administrator during its installation. This misconfiguration could expose the configuration file, which contains the plaintext administrator password. An attacker could use this password to compromise the system. How to remove this vulnerability Reinstall the I-Soft QuikStore Shopping Cart application, following the installation instructions carefully. To prevent unauthorized remote access to sensitive I-Soft QuikStore Shopping Cart files and directories, ensure that appropriate permissions have been set. References BugTraq Mailing List, Tue Apr 20 1999 13:34:57 Re: Shopping Carts exposing CC data http://www.securityfocus.com/archive/1/13363 I-Soft, LLC Web site Shopping Cart Software Program http://www.quikstore.com/ ISS X-Force QuikStore Shopping Cart misconfiguration exposes the config file http://xforce.iss.net/static/3858.php CVE CAN-1999-0607 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0607 342 Robots.txt file controls Web spiders (HTTP_RobotsTxt) IRIX reg_echo.cgi reveals server hardware information (HTTP_RegEcho) Default risk level Low Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5.2 Systems affected IRIX, Common Gateway Interface (CGI) Type Pre-attack Probe Vulnerability description Some versions of IRIX with SoftWindows installed ship by default with a CGI program called reg_echo.cgi, which returns information about the server's hardware. This information could be useful to an attacker in performing an attack. The information returned is roughly identical to that given by the MachineInfo script, also installed by default. How to remove this vulnerability Remove the reg_echo.cgi script from the CGI-BIN directory of your Web server. References ISS X-Force IRIX reg_echo.cgi reveals server hardware information http://xforce.iss.net/static/1915.php Robots.txt file controls Web spiders (HTTP_RobotsTxt) Default risk level Low Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected HTTP Type Pre-attack Probe Vulnerability description The robots.txt file is commonly placed in the root directory of a system's Web server to control the actions of Web robots (often called crawlers or spiders). All robots that adhere to the Robots Exclusion Standard (see References) will check this file on your server before proceeding to index or search your site. A user who is able to modify the contents of the robots.txt file could control the actions of Web robots on your server. How to remove this vulnerability This is not a vulnerability. Administrators should review the contents of the robots.txt file to check if the information is consistent with the policies of their organization. 343 SCO view-source CGI script allows remote users to read files (HTTP_SCO_View-Source) References The Web Robots Pages Web site A Standard for Robot Exclusion http://www.robotstxt.org/wc/norobots.html ISS X-Force Robots.txt file controls Web spiders http://xforce.iss.net/static/1533.php Nlog CGI script executes commands (HTTP_RpcNLog) Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description Nlog is a package of scripts designed to correlate and analyze output from the nmap 2.0 portscanning software. Versions up to 1.1 contain a security flaw in the way metacharacters are parsed by the rpcnlog.pl script. This flaw could allow a remote attacker to execute arbitrary commands on the server with the privileges of the user running the httpd process, usually "nobody." How to remove this vulnerability Disable access to the scripts distributed with the nlog package until you can upgrade to the latest version of nlog (1.1b or later), available from the H D Moore Web site. See References. References BugTraq Mailing List, Sat Dec 26 1998 15:56:17 Nlog 1.1b released - security holes fixed http://www.securityfocus.com/archive/1/11715 HD Moore Web site nlog http://www.digitaloffense.net/nlog/ ISS X-Force Nlog CGI script executes commands http://xforce.iss.net/static/1549.php SCO view-source CGI script allows remote users to read files (HTTP_SCO_View-Source) About this signature or vulnerability This signature detects an attack on the view-source cgi-bin script included as part of SCO Skunkware CD-ROM distributions and other httpd servers. Default risk level High 344 Malformed HTML <SCRIPT> tag could bypass firewall active content stripping (HTTP_Script_Bypass) Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The view-source CGI script distributed with some Web servers and the SCO Skunkware CD-ROM could allow a remote attacker to view files on the Web server. By accessing the view-source script with specially formatted arguments, a remote attacker can view the contents of any file on the system. The attacker is limited to reading files accessible to the user owning the server process, usually "nobody.". An attacker can use this method to list and read the files on the targeted Web server. This information could be useful to an attacker in performing an attack. How to remove this vulnerability No remedy available as of May 2001. As a workaround, remove the view-source script from the cgi-bin directory on your Web server. References BugTraq Mailing List, Sat Feb 08 1997 16:49:28 view-source http://www.securityfocus.com/archive/1/6271 ISS X-Force SCO view-source CGI script allows remote users to read files http://xforce.iss.net/static/291.php CVE CVE-1999-0174 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0174 Malformed HTML <SCRIPT> tag could bypass firewall active content stripping (HTTP_Script_Bypass) About this signature or vulnerability This signature detects HTTP data containing a malformed <SCRIPT> tag preceded by an extra "<" character. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3 Systems affected Check Point FireWall-1: 3.0 Type Suspicious Activity 345 IRIX handler CGI allows remote command execution (HTTP_SGI_Handler) Vulnerability description Some commercial firewalls, like Check Point FireWall-1, perform active content filtering where certain tags are stripped from HTML documents before being passed through the firewall. A malformed <SCRIPT> tag preceded by an extra "<" character (<<SCRIPT>) could bypass this filtering process and could allow active content to reach internal hosts. How to remove this vulnerability Check Point FireWall-1 users should upgrade to version 4.0 or later, which correctly handles malformed SCRIPT tags. References BugTraq Mailing List, Sat Jan 29 2000 06:51:46 "Strip Script Tags" in FW-1 can be circumvented http://www.securityfocus.com/archive/1/44250 BugTraq Mailing List, Tue Feb 01 2000 03:10:09 Re: "Strip Script Tags" in FW-1 can be circumvented http://www.securityfocus.com/archive/1/44439 ISS X-Force Malformed HTML <SCRIPT> tag could bypass firewall active content stripping http://xforce.iss.net/static/3905.php CVE CVE-2000-0116 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0116 IRIX handler CGI allows remote command execution (HTTP_SGI_Handler) About this signature or vulnerability This signature detects an HTTP GET request for the IRIX handler CGI program, with a pipe character contained in the URL. This could indicate an attempt by an attacker to use the handler CGI program to execute arbitrary commands on the Web server. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected IRIX: 5.3, IRIX: 6.0.1, IRIX: 6.1, IRIX: 6.2, IRIX: 6.3, IRIX: 6.4, IRIX: 6.0, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The handler cgi-bin program allows a remote attacker to execute arbitrary commands on a Web server running a vulnerable version of the program. The handler program is part of the Outbox Environment Subsystem for IRIX, installed by default on all SGI systems running IRIX 6.2 or newer. Older versions of IRIX may have this package optionally installed. How to remove this vulnerability Disable the scripts included with the IRIX Outbox Environment Subsystem and apply the workaround noted below. 346 IRIX infosrch.cgi fname variable allows remote attackers to execute commands (HTTP_SGI_Infosrch) To disable the scripts: ● Log in as root on the vulnerable system and type: # /bin/chmod 400 /var/www/cgibin/handler (assuming default install path of /var/www). ● Log in as root on the vulnerable system and remove the outbox subsystem: # /usr/ sbin/versions. -v remove outbox. As a workaround, apply the appropriate patch for your system, as listed in Silicon Graphics, Inc. Security Advisory 19970501-02-PX, which are located in the SGI FTP site. See References. References SGI Security Advisory 19970501-02-PX IRIX webdist.cgi, handler and wrap programs ftp://patches.sgi.com/support/free/security/advisories/19970501-02-PX SGI FTP site FTP ftp://patches.sgi.com/support/free/security/patches/ ISS X-Force IRIX handler CGI allows remote command execution http://xforce.iss.net/static/340.php CVE CVE-1999-0148 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0148 IRIX infosrch.cgi fname variable allows remote attackers to execute commands (HTTP_SGI_Infosrch) About this signature or vulnerability This signature detects HTTP GET requests ("infosrch.cgi?" followed by "&fname=") and a series of shell metacharacters that could allow an attacker to view files or execute arbitrary commands on the server. Default risk level High Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected IRIX: 6.5 Type Unauthorized Access Attempt Vulnerability description InfoSearch is a tool distributed by SGI that converts manual (man) pages, release notes, and other documents on the Internet into HTML format. The InfoSearch tool contains a vulnerability in the method it uses to parse input for the fname variable. This vulnerability could allow a remote attacker to view files or execute arbitrary commands on the Web server. 347 SGI Webdist CGI script allows remote command execution (HTTP_SGI_Webdist) How to remove this vulnerability Apply the appropriate patch for your system or disable the infosrch.cgi program, as listed in Silicon Graphics Inc. Security Advisory 20000501-01-P. — OR — Remove the "infosrch.cgi" program from your system's CGI-BIN directory. References BugTraq Mailing List, Wed Mar 01 2000 18:12:41 infosrch.cgi vulnerability (IRIX 6.5) http://www.securityfocus.com/archive/1/49301 BugTraq Mailing List, Mon May 22 2000 14:57:18 Vulnerability in infosrch.cgi http://www.securityfocus.com/archive/1/61369 BugTraq Mailing List, Tue May 23 2000 00:11:37 infosrch.cgi 'interactive' shell http://www.securityfocus.com/archive/1/61588 BugTraq Mailing List, Wed May 24 2000 14:57:21 Re: Vulnerability in infosrch.cgi http://www.securityfocus.com/archive/1/61750 SGI Security Advisory 20000501-01-P Vulnerability in infosrch.cgi http://www.sgi.com/support/security/advisories.html ISS X-Force IRIX infosrch.cgi fname variable allows remote attackers to execute commands http://xforce.iss.net/static/4065.php CVE CAN-2000-0207 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0207 SGI Webdist CGI script allows remote command execution (HTTP_SGI_Webdist) About this signature or vulnerability This signature detects a specially-crafted HTTP GET request for the Webdist.cgi program, which could indicate an attempt by an attacker to execute arbitrary commands on the Web server. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected IRIX: 5.3, IRIX: 6.0.1, IRIX: 6.1, IRIX: 6.2, IRIX: 6.3, IRIX: 6.4, IRIX: 6.0, Common Gateway Interface (CGI) Type Unauthorized Access Attempt 348 SGI IRIX cgi-bin wrap program remote users can list files (HTTP_SGI_Wrap) Vulnerability description The Webdist program is part of the Out Box Environment Subsystem for IRIX, installed by default on all SGI systems running IRIX 6.2 or newer. The Webdist.cgi program could allow a remote attacker to execute arbitrary commands on a remote computer with the privileges of the user owning the server process. Older versions of IRIX may have this package optionally installed. How to remove this vulnerability Disable or remove the scripts included with the IRIX Out Box Environment Subsystem and apply the appropriate patches for your system, as listed in Silicon Graphics Inc. Security Advisory 19970501-02-PX. See References. References SGI Security Advisory 19970501-02-PX IRIX webdist.cgi, handler and wrap programs ftp://patches.sgi.com/support/free/security/advisories/19970501-02-PX AUSCERT Advisory AA-97.14 SGI IRIX webdist.cgi Vulnerability ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-97.14.SGI.webdist.cgi.vul SGI Security Advisory 19970501-01-A Vulnerability in webdist.cgi ftp://patches.sgi.com/support/free/security/advisories/19970501-01-A CERT Advisory CA-1997-12 Vulnerability in webdist.cgi http://www.cert.org/advisories/CA-1997-12.html ISS X-Force SGI Webdist CGI script allows remote command execution http://xforce.iss.net/static/333.php CVE CVE-1999-0039 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0039 SGI IRIX cgi-bin wrap program remote users can list files (HTTP_SGI_Wrap) About this signature or vulnerability This signature detects an attack on the wrap cgi-bin script included as part of the WWW HTTP server shipped, with IRIX 6.2. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected IRIX: 5.3, IRIX: 6.0.1, IRIX: 6.1, IRIX: 6.2, IRIX: 6.3, IRIX: 6.4, IRIX: 6.0, Common Gateway Interface (CGI) Type Pre-attack Probe 349 Cobalt RaQ Web server could reveal user's command history (HTTP_ShellHistory) Vulnerability description The wrap CGI program is part of the Outbox Environment Subsystem for IRIX, installed by default on all SGI systems running IRIX 6.2 or newer. Older versions of IRIX may have this package optionally installed. By accessing the wrap script with specially formatted arguments, a remote attacker can obtain a listing of files on the server. This information could be useful to an attacker in performing further attacks. How to remove this vulnerability Disable or remove the scripts included with the IRIX Outbox Environment Subsystem and apply the appropriate patches for your system, as listed in Silicon Graphics Inc. Security Advisory 19970501-02-PX. See References. — AND — If possible, upgrade to the latest version of operating system running on your Web server. References SGI Security Advisory 19970501-02-PX IRIX webdist.cgi, handler and wrap programs ftp://patches.sgi.com/support/free/security/advisories/19970501-02-PX ISS X-Force SGI IRIX cgi-bin wrap program remote users can list files http://xforce.iss.net/static/290.php CVE CVE-1999-0149 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0149 Cobalt RaQ Web server could reveal user's command history (HTTP_ShellHistory) About this signature or vulnerability This signature detects HTTP GET requests containing "/.history" or "/.bash_history," which may indicate attempts by an attacker to acquire users' shell command history. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Cobalt RaQ Type Pre-attack Probe Vulnerability description The Cobalt RaQ Web server device may allow a user's shell command history to be remotely obtained. By default, the Cobalt Web server shares a user's entire directory and could reveal sensitive files, such as command history files. Any remote user can exploit this vulnerability to gain access to security-sensitive information (such as administrator passwords) contained in command history files. Also, the nature of Cobalt RaQ's setup could allow an attacker to use Web search engines to identify servers that use Cobalt RaQ. 350 Shell interpreters can be used to execute commands on Web servers (HTTP_Shells) How to remove this vulnerability Apply the ShellHistoryPatch-1.1.pkg patch, as listed in Cobalt Networks Support Knowledgebase article 469 (may require login). See References. References Wired News Online Teenager Finds Web-Server Hole http://www.wired.com/news/news/technology/story/18109.html BugTraq Mailing List, Thu Feb 25 1999 22:02:17 Cobalt root exploit http://www.securityfocus.com/archive/1/12712 Cobalt Networks, Inc. ShellHistoryPatch-1.1.pkg http://ftp.cobalt.com/pub/packages/raq1/eng/ShellHistoryPatch-1.1.pkg Cobalt Networks, Inc. Knowledge Base (may require login) 469: I noticed that the .bash_history is visible through a browser, which exposes my telnet activities. http://www.cobalt.com/support/kb/ search.php3?ques=shellhistorypatch&qid=469&language=1 ISS X-Force Cobalt RaQ Web server could reveal user's command history http://xforce.iss.net/static/1831.php CVE CVE-1999-0408 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0408 Shell interpreters can be used to execute commands on Web servers (HTTP_Shells) About this signature or vulnerability This signature detects attempts to get shells to execute commands. This signature detects any calls to shell interpreters at any location (not only the cgi-bin directory) within or outside the Web server. False positives RealSecure Network Sensor: A false positive is possible for Web pages that call shell interpreters. Even in the event of a false positive, it is still considered bad security practice to put shell interpreters (such as sh, csh, etc.) in the cgi-bin directory. A false positive is also possible, though unlikely, for a Web page that has the same name as an obscure shell interpreter (for example, "python"). RealSecure Server Sensor: A false positive is possible for Web pages that call shell interpreters. Even in the event of a false positive, it is still considered bad security practice to put shell interpreters (such as sh, csh, etc.) in the cgi-bin directory. A false positive is also possible, though unlikely, for a Web page that has the same name as an obscure shell interpreter (for example, "python"). Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.0, RealSecure Server Sensor: 5.5.2 351 Shockwave plugin allows reading of users' email (HTTP_ShockWave) Systems affected Unix, Common Gateway Interface (CGI) Type Suspicious Activity Vulnerability description A common Web server misconfiguration is to put shell interpreters (such as sh, csh, etc.) in the cgi-bin directory. Also, some early Web server documentation stated that CGI script interpreters (such as Perl, Tcl, etc.) should be placed in the cgi-bin directory. Placement of shell interpreters and CGI script interpreters in the cgi-bin directory could allow a remote attacker to execute arbitrary commands through the interpreters. By sending specially formatted HTTP requests, an attacker could cause these shells to execute arbitrary commands. For example, an attacker could send a specially formatted HTTP request that would cause password files to be emailed. Internet Scanner users: Some Web servers are configured to use non-RFC compliant message response headers, which may cause Internet Scanner to a report false positive for this vulnerability. How to remove this vulnerability Determine if any cgi-bin programs rely on shell interpreter access. If they do, move the shell interpreter outside the www root, and modify the cgi-bin programs to look for the shell interpreter in the new location. If no programs use the shell interpreter, remove it from the cgi-bin directory. Evaluate locally authored CGI executables to ensure that they do not pass unvalidated user-supplied data to system commands. References CERT Advisory CA-1996-11 Interpreters in CGI bin Directories http://www.cert.org/advisories/CA-1996-11.html ISS X-Force Shell interpreters can be used to execute commands on Web servers http://xforce.iss.net/static/146.php Shockwave plugin allows reading of users' email (HTTP_ShockWave) About this signature or vulnerability This signature detects when a Web browser attempts to obtain a file containing a Shockwave movie. Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.5 Systems affected Shockwave Plugin: 5.x and earlier Type Protocol Signature 352 SiteServer 3.0 AdSamples installation could expose SQL server login information (HTTP_SiteCsc_Access) Vulnerability description Macromedia Shockwave is a movie viewer plugin for Web browsers. Shockwave versions previous to 6.0 contain a vulnerability that allows an attacker to create a Shockwave movie with malicious content that can read email messages located on another user's system. How to remove this vulnerability Upgrade to the latest version of Shockwave (6.0 or later), available from the Shockwave Web site. See References. References Shockwave Security Alert Shockwave Security Alert : Reading Email http://www.webcomics.com/shockwave/reademail.html ISS X-Force Shockwave plugin allows reading of users' email http://xforce.iss.net/static/460.php CVE CAN-1999-1525 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1525 SiteServer 3.0 AdSamples installation could expose SQL server login information (HTTP_SiteCsc_Access) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Microsoft Site Server: All versions Type Unauthorized Access Attempt Vulnerability description Microsoft SiteServer 3.0 ships with an optional AdSamples directory intended to demonstrate the use of the Ad Server component of Site Server. If the permissions for this directory allow public access, a remote attacker could possibly retrieve a SITE.CSC file, which may contain database DSN's, logins, and passwords. This information could be useful to an attacker in performing future attacks. How to remove this vulnerability Remove the AdSamples directory from all production Web servers. As a rule, sample code and example applications should not be installed on production servers. References BugTraq Mailing List, Tue May 11 1999 15:27:38 [ALERT] Site Server 3.0 May Expose SQL IDs and PSWs http://www.securityfocus.com/archive/1/13638 ISS X-Force SiteServer 3.0 AdSamples installation could expose SQL server login information http://xforce.iss.net/static/2270.php 353 Test-cgi sample CGI script allows remote retrieval of file listings (HTTP_TestCgi) SoftCart misconfiguration exposes passwords or order information (HTTP_Softcart) About this signature or vulnerability This signature detects an HTTP GET request for Mercantec SoftCart files containing order information or server passwords. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected SoftCart Type Unauthorized Access Attempt Vulnerability description Mercantec's SoftCart Web-based shopping cart system could potentially be misconfigured by a site's administrator. This misconfiguration could expose sensitive order information or user IDs and passwords to the server. How to remove this vulnerability Reinstall the SoftCart application, following the installation instructions carefully. To prevent unauthorized remote access to sensitive SoftCart files and directories, ensure that appropriate permissions have been set. References BugTraq Mailing List, Tue Apr 20 1999 13:34:57 Re: Shopping Carts exposing CC data http://www.securityfocus.com/archive/1/13363 Mercantec, Inc. Web site Mercantec E-Commerce Solutions http://www.mercantec.com/ ISS X-Force SoftCart misconfiguration exposes passwords or order information http://xforce.iss.net/static/3856.php CVE CAN-1999-0609 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0609 Test-cgi sample CGI script allows remote retrieval of file listings (HTTP_TestCgi) About this signature or vulnerability This signature detects specially-crafted HTTP GET requests for the test-cgi program. These requests could indicate attempts by an attacker to view the contents of the cgi-bin directory or other directories on the Web server. Default risk level High 354 Suspicious URL with tilde (~) appended (HTTP_Tilde) Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected NCSA Servers: Old Versions, Apache Web Server: Old Versions, Common Gateway Interface (CGI) Type Pre-attack Probe Vulnerability description Certain conditions in the test-cgi file, shipped with older NCSA and Apache Web server packages, could allow a remote attacker to submit a query to view the contents of the cgibin directory or other directories on the Web server. This information could be useful to an attacker in performing future attacks on the system. This vulnerability can be used to change the contents of a Web page. Exploit information for this vulnerability has been widely distributed. How to remove this vulnerability Remove test-cgi, in addition to any other example CGI scripts, from your cgi-bin directory. If these scripts exist on your system, you may be running an outdated server and should upgrade to the latest version offered by your vendor. References @stake, Inc./L0pht Security Advisory 04/96 test-cgi vulnerability in certain setups http://www.atstake.com/research/advisories/1996/test-cgi-vulnerability.txt ISS X-Force Test-cgi sample CGI script allows remote retrieval of file listings http://xforce.iss.net/static/149.php CVE CVE-1999-0070 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0070 Suspicious URL with tilde (~) appended (HTTP_Tilde) About this signature or vulnerability This signature detects any attempt to access a URL with a tilde (~) appended to the URL. Default risk level Low Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected HTTP Type Suspicious Activity 355 passwd file accessed through Web server (HTTP_Unix_Passwords) Vulnerability description Many popular text editors, such as vi, create a backup copy of any file opened for editing in the current directory. Such backup files are usually renamed to something similar to the original file name with a tilde ("~") character appended. If a remote attacker accesses these backup files, the Web server could fail to apply proper ACLs (access control lists) or could fail to execute the CGI as a program, which could return the program's source code instead. Attempts to access a URL with a tilde appended to the URL may indicate that an attacker is trying to access the backup of a CGI file, instead of the original file. How to remove this vulnerability Remove backup files from directories accessible by a Web browser. When making modifications to files, do so with a text editor in an unshared directory. Some text editors, such as emacs, can be configured to suppress creating backup files. For example, a command such as (setq make-backup-files nil) in the .emacs configuration file can suppress backup copies. References GNOME 1.4 User's Guide Files and filenames http://www.labs.redhat.com/gug/users-guide/new-file.html ISS X-Force Suspicious URL with tilde (~) appended http://xforce.iss.net/static/2370.php passwd file accessed through Web server (HTTP_Unix_Passwords) About this signature or vulnerability This signature detects attempts to access the /etc/passwd file on Unix systems via a Web (HTTP) server. False positives RealSecure Network Sensor: A Web site with a legitimate URL containing “/etc/ passwd” could cause a false positive. Examine the URL reported in the event. RealSecure Server Sensor: A web site with a legitimate URL containing “/etc/passwd” could cause a false positive. Examine the URL reported in the event. Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 5.5 Systems affected Unix, HTTP Type Unauthorized Access Attempt 356 Verity search97 CGI script allows remote file reading (HTTP_Verity_Search) Vulnerability description The /etc/passwd file on Unix systems contains password information. An attacker who has accessed the etc/passwd file may attempt a brute force attack of all passwords on the system. An attacker may attempt to gain access to the etc/passwd file through a Web (HTTP) server. Typically this is done through one of the CGI scripts installed on the server. How to remove this vulnerability Examine the URL accessed and evaluate if the access attempt could have been successful. If so, consider the system compromised and all passwords exposed. Although this event is not the result of a specific vulnerability, you should take steps to ensure that your Web server and CGI scripts do not contain vulnerabilities that could allow remote access to the /etc/passwd file. References BugTraq Mailing List, Tue Aug 17 1999 10:13:48 Stupid bug in W3-msql http://www.securityfocus.com/archive/1/24442 ISS X-Force passwd file accessed through Web server http://xforce.iss.net/static/1069.php CVE CVE-1999-0753 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0753 Verity search97 CGI script allows remote file reading (HTTP_Verity_Search) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI), Verity Search`97 Type Unauthorized Access Attempt Vulnerability description A vulnerability in the search97 CGI script of Verity Search'97 Information Server could allow a remote attacker to read any file on the system. In exploiting this vulnerability, the attacker is limited to reading files accessible to the user owning the server process, usually "nobody." This vulnerability affects all versions of the Search`97 Information Server up to and including 3.1. How to remove this vulnerability Apply the patch for this vulnerability (Verity bug ID 40663), available from the Verity Customer Support site. See References. References BugTraq Mailing List, Tue Jul 14 1998 10:59:32 Verity/Search'97 Security Problems http://www.securityfocus.com/archive/1/9891 357 HTTP connections from vulnerable clients (HTTP_Vulnerable_Client) Verity Web site Verity Customer Support site https://customers.verity.com/ ISS X-Force Verity search97 CGI script allows remote file reading http://xforce.iss.net/static/1628.php HTTP connections from vulnerable clients (HTTP_Vulnerable_Client) About this signature or vulnerability This signature detects the use of a version of Internet Explorer prior to 4.01, or a version of Netscape Communicator prior to 4.61, or Netscape Navigator version 4.08 or earlier. Additional Vulnerabilities Found ■ ie-outdated ■ nav-outdated Default risk level Low Sensors that have this signature RealSecure Network Sensor: 2.0, RealSecure Server Sensor: 5.5.2 Systems affected HTTP Type Protocol Signature Vulnerability description Whenever a Web browser makes an HTTP request, it sends User Agent information in the request. This information includes the type and version of the Web browser. Earlier versions of common Web browsers have known vulnerabilities. Vulnerable browsers include the following versions of these browsers: How to remove this vulnerability ● Internet Explorer prior to version 4.01 ● Netscape Communicator prior to 4.61 ● Netscape Navigator 4.08 and below (including all stand-alone versions of Netscape Navigator) Upgrade your system's Web browser to the latest version. For Internet Explorer: ● Upgrade to the latest version of Internet Explorer (5.5 or later), available from the Microsoft Web site. See References. For Netscape Navigator or Netscape Communicator: 358 Weakness CGI Scanner (HTTP_WeaknessCGIScanner) ● References Upgrade to the latest version of Netscape Communicator (6.0 or later), available from the Netscape Web site. See References. Microsoft Windows Technologies: Internet Explorer Internet Explorer Home Page http://www.microsoft.com/windows/ie/default.htm Netscape Communications, Inc. Web site Netscape Netcenter - Download & Upgrade Page http://www.netscape.com/computing/download/index.html?cp=hom06x4 ISS X-Force HTTP connections from vulnerable clients http://xforce.iss.net/static/656.php Weakness CGI Scanner (HTTP_WeaknessCGIScanner) About this signature or vulnerability This signature detects the Weakness CGI scanner performing a scan on your network for vulnerable CGI scripts. False negatives RealSecure Network Sensor: RealSecure detects a scan by the Weakness program when Weakness performs a scan for the newdsn.exe CGI program. A false negative is possible if the Weakness source code is modified to remove this check for newdsn.exe. RealSecure Server Sensor: RealSecure detects a scan by the Weakness program when Weakness performs a scan for the newdsn.exe CGI program. A false negative is possible if the Weakness source code is modified to remove this check for newdsn.exe. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected Windows NT Type Pre-attack Probe Vulnerability description The Weakness program is a CGI scanner used to scan Web sites for vulnerable CGI scripts. A remote attacker who identifies vulnerable CGI scripts on a Web server may attempt to use various CGI exploits to gain unauthorized access to the server. How to remove this vulnerability Any sites that launch the Weakness program should be considered hostile. Determine the source site from which the Weakness program was launched, and block the site at your network's screening router or firewall. References ISS X-Force Weakness CGI Scanner http://xforce.iss.net/static/3681.php 359 WEBgais CGI script allows remote command execution (HTTP_Webgais) Web finger access attempt (HTTP_WebFinger) Default risk level Low Sensors that have this signature RealSecure Network Sensor: 3.1, RealSecure Server Sensor: 5.5.2 Systems affected Common Gateway Interface (CGI) Type Suspicious Activity Vulnerability description Some Web server configurations include a CGI finger interface, which provides a gateway for users to finger a computer through their Web browser. An attacker could use this CGI finger interface to send probes to other networks from computers on your network. How to remove this vulnerability Remove the finger utility from your CGI-BIN directory. The utility could have any name but is usually named finger or finger.pl. References ISS X-Force Web finger access attempt http://xforce.iss.net/static/1465.php WEBgais CGI script allows remote command execution (HTTP_Webgais) About this signature or vulnerability This signature requests HTTP GET requests for cgi-bin/webgais. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected WEBGais, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description WEBgais is a Web-based index/query system written in the Perl language. A vulnerability in the way the WEBgais script handles shell metacharacters could allow a remote attacker to execute commands on the remote computer with privileges of the Web server (usually "nobody"). All versions of the WEBgais package up to 1.0b2 are vulnerable. How to remove this vulnerability No remedy available as of June 2001. Disable the WEBgais script to prevent attackers from exploiting this vulnerability. 360 WebLogic FileServlet show code (HTTP_WebLogic_FileServlet_Show_Code) References BugTraq Mailing List, Thu Jul 10 1997 19:03:14 Vulnerability in WEBgais http://www.securityfocus.com/archive/1/7229 CERT Tech Tips How To Remove Meta-characters From User-Supplied Data In CGI Scripts http://www.cert.org/tech_tips/cgi_metacharacters.html ISS X-Force WEBgais CGI script allows remote command execution http://xforce.iss.net/static/1467.php CVE CVE-1999-0176 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0176 WebLogic FileServlet show code (HTTP_WebLogic_FileServlet_Show_Code) About this signature or vulnerability This signature detects URLs containing /*.shtml/ or /ConsoleHelp/, which could indicate possible attempts by an attacker to view the source of .jsp or .jhtml files on a WebLogic server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected WebLogic Enterprise: 5.1.x, WebLogic Server and Express: 4.5.x, WebLogic Server and Express: 5.1.x Type Unauthorized Access Attempt Vulnerability description BEA Systems WebLogic Enterprise 5.1, Web Logic Server 4.5x and 5.1x, and Web Logic Express 4.5x and 5.1x, could allow a remote attacker to view the source documents under the Web document root directory. A vulnerability in the ConsoleHelp servlet, if / ConsoleHelp/ is in the prefix of the file path, invokes FileServlet, which causes the pages to be displayed. How to remove this vulnerability Apply the Service Pack for the "Show Code" vulnerability, as listed in BEA Systems, Inc. Security Advisory BEA00-03.01. See References. References FreeBSD, Inc. Security Advisory FreeBSD-SA-01:24 (from SecurityFocus Archive) BEA's WebLogic force handlers show code vulnerability http://www.foundstone.com/cgi-bin/display.cgi?Content_ID=29 BEA Systems, Inc. Security Advisory BEA00-03.01 Service Pack for Show Code Vulnerability http://developer.bea.com/code/security_010306.jsp 361 WebLogic allows users to read source of files (HTTP_WebLogic_FileSourceRead) ISS X-Force WebLogic FileServlet show code http://xforce.iss.net/static/5024.php CVE CVE-2000-0682 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0682 WebLogic allows users to read source of files (HTTP_WebLogic_FileSourceRead) About this signature or vulnerability This signature detects URLs containing "/file", which could be used by an attacker to view the source of .jsp files on a WebLogic server. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected WebLogic Server, WebLogic Express Type Unauthorized Access Attempt Vulnerability description BEA WebLogic Server could reveal the source code of Java Server Pages (JSP files) on the Web server. A remote attacker could request a file, adding "/file/" before the file name in the URL, to cause the Web server to return the text source of the file to the browser, instead of compiling and executing the .jsp page. How to remove this vulnerability No remedy available as of February 2001. As a workaround, register the file servlet using wild cards or a random string, as described in WebLogic Server JSP Configuration. See References. References FreeBSD, Inc. Security Advisory FreeBSD-SA-01:10 BEA's WebLogic http://www.foundstone.com/cgi-bin/display.cgi?Content_ID=34 BEA WebLogic Server 5.1 WebLogic Server JSP Configuration http://www.weblogic.com/docs51/admindocs/lockdown.html#1111303 BugTraq Mailing List, Tue Jun 20 2000 14:36:25 BEA WebLogic /file/ showcode vulnerability http://www.securityfocus.com/archive/1/66044 ISS X-Force WebLogic allows users to read source of files http://xforce.iss.net/static/4775.php 362 BEA Systems WebLogic Java injection (HTTP_WebLogic_JavaInjection) CVE CVE-2000-0500 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0500 BEA Systems WebLogic Java injection (HTTP_WebLogic_JavaInjection) About this signature or vulnerability This signature detects URLs containing '/*.jsp/' or '/*.jhtml/' , which could indicate an attacker's attempt to inject malicious, executable Java code into files on the Web server. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2, RealSecure Server Sensor: 6.5 Systems affected WebLogic Type Unauthorized Access Attempt Vulnerability description WebLogic servers could allow a remote attacker to inject executable Java code into files on the Web server to be compiled and executed, due to the design of WebLogic handlers for JSP and JHTML files. By having such code executed, the attacker could gain administrative access to the server. How to remove this vulnerability Configure your WebLogic server as listed in BEA Systems Advisory BEA00-04.00. See References. References Foundstone Security Advisory FS-073100-10-BEA BEA WebLogic remote commmand execution vulnerability discovered by Foundstone, Inc. http://www.foundstone.com/cgi-bin/display.cgi?Content_ID=28 CERT Advisory CA-2000-02 Malicious HTML Tags Embedded in Client Web Requests http://www.cert.org/advisories/CA-2000-02.html BEA Systems, Inc. Security Advisory BEA00-04.00 Compilation and execution of arbitrary files in web document root directory http://developer.bea.com/code/alerts.jsp ISS X-Force BEA Systems WebLogic Java injection http://xforce.iss.net/static/5027.php 363 WebLogic redirect request plugin buffer overflow can be used to gain root (HTTP_WebLogic_PluginBO) WebLogic redirect request plugin buffer overflow can be used to gain root (HTTP_WebLogic_PluginBO) About this signature or vulnerability This signature detects an HTTP GET request that contains QUOT;jsp?" followed by more than 2000 characters. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected WebLogic Type Denial of Service Vulnerability description BEA WebLogic Server and WebLogic Express versions 5.1.0 and 4.5.x are vulnerable to a buffer overflow in the plugin that allows other Web servers to redirect requests to the WebLogic server. By requesting a Java Server Page (.JSP file) from the BEA WebLogic server with a URL containing 2048 characters or more, a remote attacker can overflow a buffer and crash the Web server or execute arbitrary code on the system. An attacker may be able to use this to gain root level privileges in Unix or SYSTEM privileges in Windows NT. How to remove this vulnerability Apply the proxy plug-in patch, as listed in BEA Systems, Inc. Security Advisory BEA0005.01. See References. References BEA Systems, Inc. Security Advisory BEA00-05.01 Patch Available for Buffer Overflow in BEA WebLogic Server Proxy Plug-In http://developer.bea.com/code/security_000814.jsp CORE SDI S.A. Security Advisory, August 15, 2000 Vulnerability Report for BEA Welogic's Proxy http://www.core-sdi.com/advisories/wl_libproxy_adving.htm BugTraq Mailing List, Tue Aug 15 2000 17:11:00 BEA Weblogic server proxy library vulnerabilities http://www.securityfocus.com/archive/1/76396 ISS X-Force WebLogic redirect request plugin buffer overflow can be used to gain root http://xforce.iss.net/static/5096.php CVE CVE-2000-0681 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0681 364 WebSite 1.1 for Windows NT winsample buffer overflow (HTTP_WebSite_Sample) WebGais websendmail allows remote command execution (HTTP_Websendmail) About this signature or vulnerability This signature detects HTTP POST commands containing "cgi-bin/websendmail". Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 5.5.2 Systems affected WEBGais, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The Websendmail program allows a remote attacker to execute arbitrary commands on vulnerable systems. Websendmail is a cgi-bin program that comes with the WEBgais package. WEBgais is a collection of CGI gateway programs, which incorporate the Global Area Intelligent Search (GAIS) index/query system, so that it can be used as a search engine in WWW information servers. Websendmail reads input from a form and sends email to the specified destination. Versions of WEBgais up to version 1.0b2 are vulnerable. How to remove this vulnerability No remedy available as of May 2001. As a workaround, type: # /bin/chmod 400 /usr/local/etc/httpd/cgi-bin/websendmail (replace with your cgi-bin directory as appropriate). You should disable websendmail with the workaround. References BugTraq Mailing List, Fri Jul 04 1997 08:16:31 Vulnerability in websendmail http://www.securityfocus.com/archive/1/7188 ISS X-Force WebGais websendmail allows remote command execution http://xforce.iss.net/static/296.php CVE CVE-1999-0196 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0196 WebSite 1.1 for Windows NT winsample buffer overflow (HTTP_WebSite_Sample) About this signature or vulnerability This signature detects attempts to access the win-c-sample.exe program, installed by default in the cgi-shl directory of O'Reilly WebSite versions previous to 2.0. 365 WebSite 1.1 uploader (HTTP_WebSite_Uploader) Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.0, RealSecure Server Sensor: 5.5.2 Systems affected O'Reilly Website: 2.0 and earlier, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The win-c-sample.exe program, installed by default in the cgi-shl directory of O'Reilly WebSite versions previous to 2.0, is vulnerable to a buffer overflow. A remote attacker can execute arbitrary commands on the server with the privileges of the user owning the server process. How to remove this vulnerability Remove the Win-C-Sample.exe script from the cgi-shl or cgi-bin directory. There is no legitimate use for this script, and it has been removed from O'Reilly WebSite 2.0. References O'Reilly Software Web site O'Reilly Software: WebSite http://website.oreilly.com/ ISS X-Force WebSite 1.1 for Windows NT winsample buffer overflow http://xforce.iss.net/static/295.php CVE CVE-1999-0178 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0178 WebSite 1.1 uploader (HTTP_WebSite_Uploader) About this signature or vulnerability This signature detects attempts to access uploader.exe, a program included as part of the O’Reilly WebSite 1.1 Web server. Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.0, RealSecure Server Sensor: 5.5.2 Systems affected O'Reilly Website: 2.0 and earlier, Common Gateway Interface (CGI) Type Unauthorized Access Attempt Vulnerability description The uploader.exe program, included as part of the O’Reilly WebSite 1.1 Web server, could allow a remote attacker to upload an arbitrary file to the cgi-win directory of the Web server. The file could then possibly be executed with the privileges of the http server. 366 WebSphere Application Server Host: header denial of service (HTTP_WebSphere_HeaderDoS) The uploader.exe program is installed by default in the cgi-win directory of the O'Reilly WebSite Web server. O’Reilly WebSite software versions prior to 1.1g and v2.0 beta are vulnerable. Version 2.0 is not vulnerable. How to remove this vulnerability Remove the uploader.exe file from the Web server. — AND — If you want to remain at version 1.1, install the Uploader security fix dated July 30, 1996. See References. — OR — Upgrade to the latest version of WebSite (2.0 or later), available from the O'Reilly Web site. See References. References O'Reilly Software Web site WebSite 1.1 Updates http://website.oreilly.com/support/software/ws11_updates.cfm O'Reilly Software Web site Uploader Security Fix ftp://ftp.ora.com/software/pub/support/software/website/uploader.zip Insecure.org Web site Uploader.exe insecurity http://www.insecure.org/sploits/oreily.website.uploader.exe.html ISS X-Force WebSite 1.1 uploader http://xforce.iss.net/static/294.php CVE CVE-1999-0177 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0177 WebSphere Application Server Host: header denial of service (HTTP_WebSphere_HeaderDoS) About this signature or vulnerability This signature detects an HTTP request containing a "Host:" header string that is longer than 1000 characters. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 2.2, RealSecure Server Sensor: 6.5 Systems affected WebSphere 367 Selena Sol’s WebStore could expose order information (HTTP_WebStore) Type Denial of Service Vulnerability description IBM WebSphere Application Server version 3.0.2 is vulnerable to a denial of service attack caused by a vulnerability in the WAS plugin. By sending a long string containing 1092 characters or more in the HTTP Host: request header, a remote attacker can cause the Web server process handling the request to fail on signal 11 (SIGSEGV) or signal 10 (SIGBUS). It is unlikely that this could be exploited to gain privileges or execute arbitrary commands on the Web server. How to remove this vulnerability Apply FixPack 2 for WebSphere Application Server 3.02 (3.0.2.2), available from the IBM Support site. See References. References BugTraq Mailing List, Fri Sep 15 2000 12:23:28 WebSphere application server plugin issue & vendor fix http://www.securityfocus.com/archive/1/83284 IBM WebSphere Application Server Support: E-fixes FixPacks and E-fixes http://www-4.ibm.com/software/webservers/appserv/efix.html ISS X-Force WebSphere Application Server Host: header denial of service http://xforce.iss.net/static/5252.php CVE CAN-2000-0848 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0848 Selena Sol’s WebStore could expose order information (HTTP_WebStore) About this signature or vulnerability This signature detects an HTTP GET request for the WebStore order log file. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: XPU 1.3, RealSecure Server Sensor: 5.5.2 Systems affected Selena Sol's WebStore Type Unauthorized Access Attempt Vulnerability description Selena Sol's WebStore shopping cart system could expose order information if misconfigured. If misconfigured, the order.log file may be remotely retrievable by remote attackers. This file contains sensitive information about purchases made with this system. 368 WindMail remote file retrieval (HTTP_WindMail_FileRead) How to remove this vulnerability Reinstall the WebStore Shopping Cart application, following the installation instructions carefully. To prevent unauthorized remote access to sensitive WebStore Shopping Cart files and directories, ensure that appropriate permissions have been set. References BugTraq Mailing List, Tue Apr 20 1999 13:34:57 Re: Shopping Carts exposing CC data http://www.securityfocus.com/archive/1/13363 Foundry Networks Web site Webstore http://www.extropia.com/scripts/web_store.html ISS X-Force Selena Sol’s WebStore could expose order information http://xforce.iss.net/static/3861.php CVE CAN-1999-0604 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0604 WindMail remote file retrieval (HTTP_WindMail_FileRead) About this signature or vulnerability This signature detects an HTTP GET request for the WindMail program. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected WindMail Type Unauthorized Access Attempt Vulnerability description WindMail is a command-line email messenger for Windows. WindMail works with CGI scripts that manage forms on Web sites. Normally, the CGI scripts pass form information to WindMail and command it to send an email containing the information. An attacker can exploit this feature of WindMail through a Web browser by typing a URL containing certain instructions to the WindMail executable. Such a specially crafted URL can command WindMail to email any file on the vulnerable system to the attacker. How to remove this vulnerability No remedy available as of March 2000. References BugTraq Mailing List, Sat Mar 25 2000 22:41:46 Windmail allow web user get any file http://www.securityfocus.com/archive/1/52810 369 WWWThreads SQL commands could allow users to gain privileges (HTTP_WWWThreads_Admin) ISS X-Force WindMail remote file retrieval http://xforce.iss.net/static/4188.php CVE CAN-2000-0242 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0242 Executable command in HTTP path (HTTP_Windows_Executable) About this signature or vulnerability This signature detects attempts by an attacker to embed an executable command (.EXE) in Web (HTTP) traffic. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected Windows NT, Windows 2000 Type Protocol Signature Vulnerability description Executable commands in Microsoft Windows environments typically possess an .EXE file extension. A remote attacker could embed such an executable command in Web (HTTP) traffic to launch a variety of attacks on a victim computer. For example, a remote attacker could launch the Windows executable c:\winnt\system32\cmd.exe by embedding the executable command in Web traffic. How to remove this vulnerability Restrict remote program execution to only those applications and users that require this capability. References ISS X-Force Executable command in HTTP path http://xforce.iss.net/static/6842.php WWWThreads SQL commands could allow users to gain privileges (HTTP_WWWThreads_Admin) About this signature or vulnerability This signature detects someone attempting to write or gain access to SQL Server through a vulnerability in the WWWThreads software. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 370 HVL-RAT backdoor for Windows and AOL (Hvl_Rat) Systems affected WWWThreads: prior to 5.0 Type Unauthorized Access Attempt Vulnerability description Versions of the WWWThreads software prior to 5.0 allow remote users to submit SQL commands though online forms to gain privileges. WWWThreads is a Web bulletin board program that uses uses a SQL database. Due to insufficient input validation in the source code, an attacker could send SQL commands through forms to manipulate the contents of the database and to gain administrator database privileges. How to remove this vulnerability Upgrade to WWWThreads Pro version 5.0 or later, or a demo version of WWWThreads released after 02/01/00, available from the WWWThreads Web site. See References. References BugTraq Mailing List, Wed Feb 02 2000 19:33:03 RFP2K01 - "How I hacked Packetstorm" (wwwthreads advisory) http://www.securityfocus.com/archive/1/44863 WWWThreads Web site WWWThreads Download Area - Demo Version http://www.wwwthreads.com/download.html WWWThreads Demo / Support Forum 5.0 release and demo update - urgent upgrades http://www.wwwthreads.com/perl/ showflat.pl?Cat=&Board=info&Number=9932&page=1&view=collapsed&sb=5 ISS X-Force WWWThreads SQL commands could allow users to gain privileges http://xforce.iss.net/static/4011.php CVE CAN-2000-0125 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0125 HVL-RAT backdoor for Windows and AOL (Hvl_Rat) About this signature or vulnerability This signature detects a TCP connection on port 1099 to an HVL-RAT backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt 371 HVL-RAT backdoor for Windows and AOL (Hvl_Rat) Vulnerability description How to remove this vulnerability The HVL-RAT backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the HVL-RAT backdoor, an attacker can do the following: ● shut down or restart your computer ● detect your IP address ● detect your America Online username and password ● use your computer's microphone to record sounds To remove HVL-RAT from your computer: 1. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. 2. Find the registry entry named Explorer that has a data value of C:\Windows\System\Msgsvr16.exe. 3. Delete this registry entry. 4. Delete MsgSvr16.exe from the Windows system directory. References The Xploiter Web site XPloiter - Rat Trojan http://www.xploiter.com/security/rat.html ISS X-Force HVL-RAT backdoor for Windows and AOL http://xforce.iss.net/static/3110.php 372 HVL-RAT backdoor for Windows and AOL (Hvl_Rat) 373 Linux identd configuration remote denial of service (Ident_Linux_DoS) Ident errors may indicate probe of Ident service (Ident_Error) About this signature or vulnerability This signature detects Ident errors, which could indicate attempts by an attacker to identify open connections between particular systems or probe your network for configuration information. Default risk level High Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 6.5 Systems affected Unix Type Suspicious Activity Vulnerability description Ident, the Identification protocol, allows a server to ask a client system for the local username associated with a given network connection between the two systems. This is done by the server opening an Ident connection back to the client, and specifying the pair of port numbers (local and remote) for which it would like a username report. If no such connection exists, or if the request from the server is otherwise malformed, the Ident process on the client will report an error. Probes of the Ident service might be used by an attacker to identify open connections between particular systems. It can also be used to remotely reveal configuration information (such as which processes are running as root). However, such probes often result in a few error reports as the attacker attempts different port numbers. How to remove this vulnerability Examine the destination address of this event, which could be an attacking system. Watch for other events originating at that address. References ISS X-Force Ident errors may indicate probe of Ident service http://xforce.iss.net/static/1070.php Linux identd configuration remote denial of service (Ident_Linux_DoS) About this signature or vulnerability This signature detects that more than 100 identd connections have occurred within 30 seconds. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected SuSE Linux 374 Ident newline allows remote users to execute commands (Ident_Newline) Type Denial of Service Vulnerability description In some Linux distributions, identd is started with inetd.conf with the options -w -t120. Once an identd connection is made to the server, the server will wait 120 seconds before answering another connection. By sending a large number of identd connections to the server in a short period of time, a remote attacker could cause the server to use up all available memory and crash the system. How to remove this vulnerability Reconfigure the in.identd daemon to prevent it from waiting on connections. To prevent the in.identd daemon from waiting on connections: 1. Change the start flag for in.identd in /etc/inetd.conf from — OR — to "nowait" 2. Change the in.identd options from "-w -t120 -e" to "-i -e". — OR — For stronger security, consider not running identd. References BugTraq Mailing List, Sat Aug 14 1999 12:29:48 DOS against SuSE's identd http://www.securityfocus.com/archive/1/24244 SuSE Security Announcement #12 Security hole in netcfg http://www.suse.de/de/support/security/suse_security_announce_12.txt ISS X-Force Linux identd configuration remote denial of service http://xforce.iss.net/static/3128.php CVE CVE-1999-0746 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0746 Ident newline allows remote users to execute commands (Ident_Newline) About this signature or vulnerability This signature detects an Ident response containing a newline character. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 6.5 Systems affected Sendmail Type Unauthorized Access Attempt 375 Ident buffer overflow allows remote users to execute commands (Ident_Overflow) Vulnerability description Certain programs that connect back to the Ident service to log user information expect a properly formatted response. If the response contains newlines, the response may be improperly parsed, allowing the remote user to append commands to an Ident response that will be executed by the target system with root-level access. How to remove this vulnerability Upgrade to the latest version of Sendmail (8.11.2 or later), available from the Sendmail Web site. See References. References Sendmail Consortium Web site Current Release http://www.sendmail.org/ CIAC Information Bulletin F-13 Unix Sendmail Vulnerabilities http://www.ciac.org/ciac/bulletins/f-13.shtml BugTraq Mailing List, Thu Feb 23 1995 03:49:08 Re: Sendmail 8.6.9 security hole http://www.securityfocus.com/archive/1/2225 RootShell smh.c exploit smh.c - Michael R. Widner - atreus (2/27/95) http://www.rootshell.com/archive-j457nxiqi3gq59dv/199707/smh.c.html ISS X-Force Ident newline allows remote users to execute commands http://xforce.iss.net/static/628.php CVE CVE-1999-0204 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0204 Ident buffer overflow allows remote users to execute commands (Ident_Overflow) Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Sendmail Type Unauthorized Access Attempt Vulnerability description Sendmail is a Mail Transport Agent (MTA) used on many Unix-based operating systems. Sendmail version 8.6.9 connects back to the ident service to log user information. This version of Sendmail does not validate the information returned by the client. If the response by the client to Sendmail is longer than expected, the response overflows the buffer. This condition could allow a remote attacker to execute commands on the host system and gain privileged access to the system. 376 Ident user (Ident_User) How to remove this vulnerability Upgrade to the latest version of Sendmail (8.11.2 or later), available from the Sendmail Web site. See References. References Sendmail Consortium Web site Sendmail Homepage http://www.sendmail.org CIAC Information Bulletin F-13 Unix Sendmail Vulnerabilities http://www.ciac.org/ciac/bulletins/f-13.shtml BugTraq Mailing List, Thu Feb 23 1995 03:43:13 Re: Sendmail 8.6.9 security hole http://www.securityfocus.com/archive/1/2235 ISS X-Force Ident buffer overflow allows remote users to execute commands http://xforce.iss.net/static/627.php CVE CVE-1999-0204 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0204 Ident user (Ident_User) Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Any Type Protocol Signature Vulnerability description Services use the Ident port to identify the account by which a connection is being made on a computer. This information can be used to track a connection back to a specific user on a multi-user computer. How to remove this vulnerability Consider enabling identd on internal hosts that do not generate ident events. References ISS X-Force Ident user http://xforce.iss.net/static/657.php 377 Internet Explorer allows active content to be automatically downloaded (HTTP_ActiveX) Internet Explorer allows active content to be automatically downloaded (HTTP_ActiveX) About this signature or vulnerability This vulnerability is detected by the HTTP_ActiveX signature. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 2.5 Systems affected Windows 95, Windows NT: 4.0 Type Protocol Signature Vulnerability description The Web browser allows active content to be automatically downloaded from the HTML page that contains the content. Potentially malicious or virus-infected programs may be stored on the local file system. How to remove this vulnerability In Internet Explorer 3.x, from the Options dialog box, go to Security and disable Allow Downloading of Active Content. 1. Open Internet Explorer 3.x. 2. From the View menu, select Options. 3. Click the Security tab. 4. Disable the Allow Downloading of Active Content option. 5. Click OK to apply the changes. In Internet Explorer 5.x, from the Internet Options dialog box, go to Security and disable the appropriate settings under Downloads. 1. Open Internet Explorer 5.x. 2. From the Tools menu, select Internet Options. 3. Click the Security tab, and then click Custom Level. 4. From the Downloads folder, locate the advanced feature and set it to the recommended value. 5. Click OK to apply the changes. References ISS X-Force Internet Explorer allows active content to be automatically downloaded http://xforce.iss.net/static/353.php 378 Attempt to read or modify an 802.11 device's SSID (SNMP_Suspicious_Set) Internet Explorer is outdated (HTTP_Vulnerable_Client) About this signature or vulnerability This vulnerability is detected by the HTTP_Vulnerable_Client signature. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 2.5 Systems affected Windows NT, Windows 95, Windows NT: 4.0, Windows 98 Type Protocol Signature Vulnerability description An outdated version of Microsoft Internet Explorer has been detected. All versions of Internet Explorer prior to 4.01 are known to have security issues. How to remove this vulnerability Apply the latest Service Pack for Internet Explorer 5.5 (Service Pack 1 or later), available from the Microsoft Web site. See References. Windows NT Apply the Explorer 4.0 Freiburg, Bell Labs Java-Script and the DirectX patches. References Microsoft Internet Explorer Web site Welcome to the Internet Explorer Home Page http://www.microsoft.com/windows/Ie/default.htm Microsoft Web site 5.5 it works faster to save you time http://www.microsoft.com/windows/Ie/default.htm ISS X-Force Internet Explorer is outdated http://xforce.iss.net/static/361.php CVE CAN-1999-0662 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0662 Attempt to read or modify an 802.11 device's SSID (SNMP_Suspicious_Set) About this signature or vulnerability This signature detects an attempt to read or change the SSID (Security Set Identifier) of an 802.11 device. This is detected by the SNMP_Suspicious_Get signature. Default risk level High 379 Attempt to read or modify an 802.11 device's WEP encryption key (SNMP_Suspicious_Set) Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point, Enterasys RoamAbout PC Card: 802.11, Enterasys RoamAbout Access Point, Cisco Aironet Access Point, ORiNOCO Access Points, Cisco Aironet 350 Series Access Point Type Suspicious Activity Vulnerability description An attempt is being made to read or modify the SSID (Security Set Identifier) of an 802.11 access point. An attacker could use SSID information to gain access to the wireless network. This event should be considered particularly suspicious if your access point is not configured to broadcast the SSID. How to remove this vulnerability Ensure that the 802.11 device is properly configured. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B Cisco Technology Solutions Wireless Solutions http://www.cisco.com/warp/public/779/smbiz/netsolutions/find/wireless.shtml Agere Systems Web site ORiNOCO Wireless LAN http://www.orinocowireless.com/ Enterasys Web site Enterasys Wireless Solutions: RoamAbout http://www.enterasys.com/wireless/ Internet Security Systems Web site Securing E-business: Wireless LAN Security http://www.iss.net/wireless/ ISS X-Force Attempt to read or modify an 802.11 device's SSID http://xforce.iss.net/static/6519.php Attempt to read or modify an 802.11 device's WEP encryption key (SNMP_Suspicious_Set) About this signature or vulnerability This signature detects an attempt to read or change the WEP (Wired Equivalent Privacy) encryption key of an 802.11 device. This is detected by the SNMP_Suspicious_Get signature. Default risk level High 380 IMail buffer overflow in built-in LDAP server (Imail_ldap_Overflow) Sensors that have this signature RealSecure Network Sensor: XPU 3.1, RealSecure Network Sensor: XPU 3.1 Systems affected 3Com AirConnect Access Point, Enterasys RoamAbout PC Card: 802.11, Enterasys RoamAbout Access Point, Cisco Aironet Access Point, ORiNOCO Access Points, Cisco Aironet 350 Series Access Point Type Suspicious Activity Vulnerability description An attempt is being made to read or modify the WEP (Wired Equivalent Privacy) encryption key of an 802.11 access point. An attacker could use encryption key information to gain access to a wireless network. How to remove this vulnerability Ensure that the 802.11 device is properly configured. Change the WEP key if it has been read by a suspicious computer. References 3Com Product Support 3Com® AirConnect® 11 Mbps Wireless LAN Access Point http://www.3com.com/products/en_US/ detail.jsp?tab=support&pathtype=support&sku=3CRWE74796B Cisco Technology Solutions Wireless Solutions http://www.cisco.com/warp/public/779/smbiz/netsolutions/find/wireless.shtml Agere Systems Web site ORiNOCO Wireless LAN http://www.orinocowireless.com/ Enterasys Web site Enterasys Wireless Solutions: RoamAbout http://www.enterasys.com/wireless/ Internet Security Systems Security Alert #84 Wired-side SNMP WEP key exposure in 802.11b Access Points http://xforce.iss.net/alerts/advise84.php Internet Security Systems Web site Securing E-business: Wireless LAN Security http://www.iss.net/wireless/ ISS X-Force Attempt to read or modify an 802.11 device's WEP encryption key http://xforce.iss.net/static/6520.php IMail buffer overflow in built-in LDAP server (Imail_ldap_Overflow) About this signature or vulnerability This signature detects a character string greater than 2375 bytes being sent to port 389, the IMail LDAP server port. 381 IMAP2bis server, anonymous login successful (IMAP2bis_server_anonymous_login_successful) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected IMail Type Denial of Service Vulnerability description IMail is a multi-protocol mail server for Windows NT. Versions 5.0 and earlier of IMail are vulnerable to a buffer overflow in the LDAP server. By sending a large number of characters to the LDAP server, a remote attacker can overflow the buffer and cause the LDAP service to consume all available resources on the server. It is not known whether an attacker can use this vulnerability to execute arbitrary code. How to remove this vulnerability No remedy available as of November 2000. References eEye Digital Security Team Alert AD03011999 Multiple IMail Vulnerabilites http://www.eeye.com/html/Research/Advisories/AD19990301.html Ipswitch, Inc. Product Information IMail Server by Ipswitch http://www.ipswitch.com/Products/IMail_Server/index.asp ISS X-Force IMail buffer overflow in built-in LDAP server http://xforce.iss.net/static/1896.php IMAP2bis server, anonymous login successful (IMAP2bis_server_anonymous_login_successful) About this signature or vulnerability This signature detects the following syslog message generated by the IMAP2bis service: "Login anonymous" Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IMAP2bis (Internet Mail Access Protocol) service has historically been targeted by attackers. This service records access events in the Unix syslog. It may be helpful to create 382 IMAP2bis Server, brute force attack (IMAP2bis_server_brute_force_attack) an audit history of these events, by monitoring the service's syslog messages. Normal access attempts at unexpected times or under unusual circumstances may reveal the presence of an attacker. How to remove this vulnerability This event is likely the result of normal user activity. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IMAP2bis server has occurred. References ISS X-Force IMAP2bis server, anonymous login successful http://xforce.iss.net/static/1622.php IMAP2bis Server, brute force attack (IMAP2bis_server_brute_force_attack) About this signature or vulnerability This signature detects the following syslog message generated by the IMAP2bis service: "Excessive login failures" Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IMAP2bis (Internet Mail Access Protocol) service has historically been targeted by attackers. This service records access attempts in the Unix syslog, as well as events that are associated with specific attacks. Certain direct attacks against the IMAP2bis service can be detected in this way. It may also be helpful to create an audit history of successful and failed access events by monitoring the service's syslog messages. How to remove this vulnerability This event likely indicates a direct attack against the IMAP2bis service, which requires immediate response from an administrator. Log in to the Unix host in question and terminate any user process that is obviously the source of the attack. Consider immediately shutting down the service and curtailing access. Investigate the need to upgrade or patch the service. References ISS X-Force IMAP2bis Server, brute force attack http://xforce.iss.net/static/1561.php 383 IMAP2bis Server, user Auto-logout (IMAP2bis_server_user_auto-logout) IMAP2bis Server, pre-authenticated user login successful (IMAP2bis_server_preauthenticated_user_login_successful) About this signature or vulnerability This signature detects the following syslog message generated by the IMAP2bis service: "Preauthenticated user" Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IMAP2bis (Internet Mail Access Protocol) service has historically been targeted by attackers. This service records access events in the Unix syslog. It may be helpful to create an audit history of these events, by monitoring the service's syslog messages. Normal access attempts at unexpected times or under unusual circumstances may reveal the presence of an attacker. How to remove this vulnerability This event is likely the result of normal user activity. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IMAP2bis server has occurred. References ISS X-Force IMAP2bis Server, pre-authenticated user login successful http://xforce.iss.net/static/1616.php IMAP2bis Server, user Auto-logout (IMAP2bis_server_user_auto-logout) About this signature or vulnerability This signature detects the following syslog message generated by the IMAP2bis service: "Autologout user" Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor 384 IMAP2bis Server, user login failure (IMAP2bis_server_user_login_failure) Vulnerability description The IMAP2bis (Internet Mail Access Protocol) service has historically been targeted by attackers. This service records access events in the Unix syslog. It may be helpful to create an audit history of these events, by monitoring the service's syslog messages. Normal access attempts at unexpected times or under unusual circumstances may reveal the presence of an attacker. How to remove this vulnerability This event is likely the result of normal user activity. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IMAP2bis server has occurred. References ISS X-Force IMAP2bis Server, user Auto-logout http://xforce.iss.net/static/1563.php IMAP2bis Server, user login failure (IMAP2bis_server_user_login_failure) About this signature or vulnerability This signature detects the following syslog message generated by the IMAP2bis service: "Login failure" Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IMAP2bis (Internet Mail Access Protocol) service has historically been targeted by attackers. This service records failed access events in the Unix syslog. It may be helpful to create an audit history of these events, by monitoring the service's syslog messages. Failed access attempts may indicate an access error or an attempt by an attacker to probe your network.. How to remove this vulnerability This event may indicate that a user is having difficulty using the service, or it may indicate the presence of an attacker. Log in to the Unix host in question and determine who is accessing the service and if they have a legitimate reason to do so. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IMAP2bis server has occurred. References ISS X-Force IMAP2bis Server, user login failure http://xforce.iss.net/static/1562.php 385 IMAP2bis Server, user logout (IMAP2bis_server_user_logout) IMAP2bis Server, user login successful (IMAP2bis_server_user_login_successful) About this signature or vulnerability This signature detects the following syslog message generated by the IMAP2bis service: "Login user" Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IMAP2bis (Internet Mail Access Protocol) service has historically been targeted by attackers. This service records access events in the Unix syslog. It may be helpful to create an audit history of these events, by monitoring the service's syslog messages. Normal access attempts at unexpected times or under unusual circumstances may reveal the presence of an attacker. How to remove this vulnerability This event is likely the result of normal user activity. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IMAP2bis server has occurred. References ISS X-Force IMAP2bis Server, user login successful http://xforce.iss.net/static/1621.php IMAP2bis Server, user logout (IMAP2bis_server_user_logout) About this signature or vulnerability This signature detects the following syslog message generated by the IMAP2bis service: "Logout user" Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IMAP2bis (Internet Mail Access Protocol) service has historically been targeted by attackers. This service records access events in the Unix syslog. It may be helpful to create 386 IMAP AUTHENTICATE overflow could allow remote root access (IMAP_Authenticate_Overflow) an audit history of these events, by monitoring the service's syslog messages. Normal access attempts at unexpected times or under unusual circumstances may reveal the presence of an attacker. How to remove this vulnerability This event is likely the result of normal user activity. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IMAP2bis server has occurred. References ISS X-Force IMAP2bis Server, user logout http://xforce.iss.net/static/1564.php IMAP AUTHENTICATE overflow could allow remote root access (IMAP_Authenticate_Overflow) About this signature or vulnerability This signature detects a specially-crafted "AUTHENTICATE" command to the IMAP server. The "AUTHENTICATE" command contains an unusually large argument, which could indicate an attempt by an attacker to overflow a buffer to execute arbitrary commands on the IMAP server. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.3, RealSecure Server Sensor: 6.5 Systems affected Internet Message Access Protocol (IMAP), Red Hat Linux: 4.2, Sun Internet Mail Server: 3.x, Sun Internet Mail Server: 2.0 Type Unauthorized Access Attempt Vulnerability description The Internet Message Access Protocol (IMAP), version 4rev1 (IMAP4rev1) allows a client to access and manipulate electronic mail messages on a server. IMAP4rev1 servers up to and including version 10.234 are vulnerable to a buffer overflow in the IMAP AUTHENTICATE command. By submitting a specially-crafted IMAP AUTHENTICATE command to the IMAP server, an attacker could overflow a buffer to execute arbitrary commands on the victim site as the user running imapd, usually root. This vulnerability is not the vulnerability described in CERT Advisory CA-97.09, which describes a buffer overflow in the IMAP LOGIN command. Fixed versions of IMAP were distributed under the 10.234 version number as well, so version numbers alone should not be used to determine whether or not a server is vulnerable to this attack. How to remove this vulnerability For Sun Microsystems: Apply the appropriate patch for your system, as listed in Sun Microsystems, Inc. Security Bulletin #00177. See References. 387 IMail IMAP service buffer overflow (IMAP_Imail_Overflow) For Silicon Graphics, Inc.: Upgrade to the latest version of the imapd daemon, available from the University of Washington FTP server. See References. For other distributions: Contact your vendor for upgrade or patch information. References CERT Advisory CA-1998-09 Buffer Overflow in Some Implementations of IMAP Servers http://www.cert.org/advisories/CA-1998-09.html Sun Microsystems, Inc. Security Bulletin #00177 IMAP http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=secbull/177 SGI Security Advisory 19980802-01-I University of Washington imapd daemon Vulnerability ftp://patches.sgi.com/support/free/security/advisories/19980802-01-I Pine Discussion Forum Attention: Please update your imapd http://www.washington.edu/pine/pine-info/1998.07/msg00062.html BugTraq Mailing List, Thu Jul 16 1998 19:06:30 EMERGENCY: new remote root exploit in UW imapd http://www.securityfocus.com/archive/1/9929 Washington University Washington University FTP site ftp://ftp.cac.washington.edu/mail/imap.tar.Z CIAC Information Bulletin I-074 Buffer Overflow in Some Implementations of IMAP Servers http://www.ciac.org/ciac/bulletins/i-074.shtml ISS X-Force IMAP AUTHENTICATE overflow could allow remote root access http://xforce.iss.net/static/1463.php CVE CVE-1999-0005 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0005 IMail IMAP service buffer overflow (IMAP_Imail_Overflow) About this signature or vulnerability This signature detects unusually large login commands to the IMAP server, which could indicate attempts by an attacker to overflow a buffer and crash the IMAP service. Default risk level Medium 388 Microsoft Outlook date header buffer overflow (IMAP_Outlook_Date_Overflow) Sensors that have this signature RealSecure Network Sensor: XPU 2.3 Systems affected IMail Type Denial of Service Vulnerability description IMail is a popular multi-protocol mail server for Windows NT environments. IMail version 5.0 is vulnerable to a buffer overflow in the login command of the IMAP server. An attacker could submit a specially-crafted username or password to overflow a buffer and crash the service. It is not known whether this buffer overflow can be manipulated to gain unauthorized access to the system. How to remove this vulnerability No remedy available as of March 2001. References Ipswitch, Inc. Product Information IMail Server by Ipswitch http://www.ipswitch.com/Products/IMail_Server/index.asp eEye Digital Security Team Alert AD03011999 Multiple IMail Vulnerabilities Multiple IMail Vulnerabilites http://www.eeye.com/html/Research/Advisories/AD19990301.html ISS X-Force IMail IMAP service buffer overflow http://xforce.iss.net/static/1895.php CVE CAN-1999-1557 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1557 Microsoft Outlook date header buffer overflow (IMAP_Outlook_Date_Overflow) About this signature or vulnerability The IMAP_Outlook_Date_Overflow signature detects IMAP4 server traffic containing a "Date:" line longer than 70 characters. Configurable Parameters: The length of the "Date:" line this signature detects can be configured in the Policy Editor for IMAP_Outlook_Date_Overflow. False positives RealSecure Network Sensor: A false positive is possible if any line in an email received by IMAP4 contains the text "Date:" and is 150 characters long. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 1.3 389 Microsoft Outlook date header buffer overflow (IMAP_Outlook_Date_Overflow) Systems affected Windows NT, Microsoft Outlook: 98, Microsoft Outlook Express: 5.0, Windows 2000, Microsoft Outlook Express: 4.0, Microsoft Outlook: 2000, Microsoft Outlook: 97 Type Unauthorized Access Attempt Vulnerability description Microsoft Outlook and Microsoft Outlook Express are vulnerable to a buffer overflow in the inetcomm.dll component shared by both programs. By sending an email message with a long date header value, using either the POP3 or IMAP4 protocols, a remote attacker can overflow the buffer and execute arbitrary code on the system. The user does not have to open the message for the attack to be successful. A malicious email can begin executing code when it is retrieved from the server, before the user previews or opens the message. Only the POP3 and IMAP4 Internet email protocols are affected by this vulnerability. Microsoft Outlook also supports the MAPI (Microsoft Messaging API), the protocol used by Microsoft Exchange. Outlook users who retrieve mail using MAPI, and do not use either POP3 and IMAP4, are not affected by this vulnerability. How to remove this vulnerability For Internet Explorer 5.01: Apply the critical security patch, as listed in Microsoft Security Bulletin MS00-043. See References. For all other versions of Internet Explorer: Upgrade to Internet Explorer 5.01 Service Pack 1 or Internet Explorer 5.5, as listed in Microsoft Security Bulletin MS00-043. See References. (Windows 2000 users: Upgrading to Internet Explorer 5.5 does not correct this vulnerability on Windows 2000 systems.) Windows NT Apply the "Malformed E-mail Header" patch detailed in Microsoft Security Bulletin MS00-043 Windows 2000 Apply the "Malformed E-mail Header" patch detailed in Microsoft Security Bulletin MS00-043 References Microsoft Security Bulletin MS00-043 Patch Available for 'Malformed E-mail Header' Vulnerability http://www.microsoft.com/technet/security/bulletin/MS00-043.asp Internet Security Systems Security Alert #57 Buffer Overflow in Microsoft Outlook and Outlook Express Mail Clients http://xforce.iss.net/alerts/advise57.php Underground Security Systems Research advisory USSR-2000050 Remotely Exploitable Buffer Overflow in Outlook 'Malformed E-mail MIME Header' Vulnerability http://www.ussrback.com/labs50.html Microsoft TechNet Microsoft Security Bulletin (MS00-043):Frequently Asked Questions http://www.microsoft.com/technet/security/bulletin/fq00-043.asp 390 IMAP login buffer overflow could allow remote root access (IMAP_Overflow) Microsoft Knowledge Base Article Q267884 E-mail Security Vulnerability Fixed in Internet Explorer 5.01 SP1 http://www.microsoft.com/technet/support/kb.asp?ID=267884 CIAC Information Bulletin K-060 Microsoft's Malformed E-Mail Header Vulnerability http://www.ciac.org/ciac/bulletins/k-060.shtml ISS X-Force Microsoft Outlook date header buffer overflow http://xforce.iss.net/static/4953.php CVE CVE-2000-0567 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0567 IMAP login buffer overflow could allow remote root access (IMAP_Overflow) About this signature or vulnerability This signature detects an IMAP login with an unusually large username (greater than 512 characters). Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 6.5 Systems affected Internet Message Access Protocol (IMAP) Type Unauthorized Access Attempt Vulnerability description IMAP is a remote mail reading protocol designed as an enhancement of the POP2/POP3 protocols. A vulnerability in both the University of Washington's and Mark Crispin's IMAP implementation could allow a remote attacker to gain unauthorized root access. This vulnerability also affects the POP3 servers shipped with these packages. How to remove this vulnerability Apply the appropriate IMAP patch or upgrade for your system, as listed in CERT Advisory CA-1997-09. See References. For Checkpoint Firewall-1: Contact Checkpoint Support for patch or upgrade information. See References. For other distributions, contact your vendor for patch or upgrade information. References CERT Advisory CA-1997-09 Vulnerability in IMAP and POP http://www.cert.org/advisories/CA-1997-09.html 391 IMAP password (IMAP_Password) University of Washington Web site UW IMAP Information Center http://www.washington.edu/imap/ Network Associates, Inc. COVERT Labs Security Advisory #22 Buffer Overflow in imapd and ipop3d http://www.pgp.com/research/covert/advisories/022.asp SGI Security Advisory 19980302-01-I IMAP/POP Vulnerability ftp://patches.sgi.com/support/free/security/advisories/19980302-01-I Check Point Web site Check Point Software Technologies http://www.checkpoint.com/ ISS X-Force IMAP login buffer overflow could allow remote root access http://xforce.iss.net/static/1637.php IMAP password (IMAP_Password) About this signature or vulnerability This signature detects all successfully used passwords submitted by a user attempting to log on to a mail server using IMAP. Submitted passwords are transmitted in cleartext to RealSecure log files, so care should be taken to secure the log files. In combination with other email signatures, this signature can help to construct a log of email activity. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Internet Message Access Protocol (IMAP) Type Protocol Signature Vulnerability description The Internet Messaging Access Protocol (IMAP) service is used by numerous email programs to retrieve email from a mail server and read it on a local computer. Single, regularly spaced events of users logging on to a mail server are typical IMAP behavior. However, a high frequency of these events (many within a short time period) could indicate a possible brute force username or password guessing attack. How to remove this vulnerability Examine the frequency of the queries as well as the source address. A high frequency of these events is suspicious. Consider blocking access to the mail server for the source address. IMAP should typically not be allowed from remote locations, due to the difficulty in securing the connection and the fact that IMAP transmits passwords in cleartext. 392 Infector backdoor for Windows (Infector) References ISS X-Force IMAP password http://xforce.iss.net/static/658.php IMAP username (IMAP_User) About this signature or vulnerability This signature detects all successfully and unsuccessfully used passwords submitted by a user attempting to log on to a mail server using IMAP. In combination with other email signatures, this signature can help to construct a log of email activity. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Internet Message Access Protocol (IMAP) Type Protocol Signature Vulnerability description The Internet Messaging Access Protocol (IMAP) service is used by numerous email programs to retrieve email from a mail server and read it on a local computer. Single, regularly spaced events of users attempting to log on to a mail server are typical IMAP behavior. However, a high frequency of these events (many within a short time period) could indicate a possible brute force username or password guessing attack. How to remove this vulnerability Examine the frequency of the queries as well as the source address. A high frequency of these events is suspicious. Consider blocking access to the mail server for the source address. IMAP should typically not be allowed from remote locations, due to the difficulty in securing the connection and the fact that IMAP transmits passwords in cleartext. References ISS X-Force IMAP username http://xforce.iss.net/static/659.php Infector backdoor for Windows (Infector) About this signature or vulnerability This signature detects a TCP connection on port 19 or port 146 to an Infector backdoor on your network. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows 95, Windows 98 393 Infector backdoor for Windows (Infector) Type Unauthorized Access Attempt Vulnerability description The Infector backdoor is one of many backdoor programs for Windows 95 and Windows 98 that attackers can use to access your computer system without your knowledge or consent. With the Infector backdoor, an attacker can execute programs, and upload and download files. The Infector backdoor is mainly used for initially infecting a system to upload more feature-rich backdoors, such as SubSeven or Back Orifice 2000. When the Infector backdoor is executed, it binds to TCP port 146 and awaits a connection from the attacker's client. Later versions also bind to TCP port 17569. File transfers are implemented as a lightweight FTP server that binds to TCP port 19. How to remove this vulnerability To remove Infector from your computer: 1. Using Notepad, open C:\Windows\System.ini. 2. Under "[boot]" find the line that begins with "shell=Explorer.exe". 3. Remember the path and file name appended to this line. This is the location of the backdoor server. 4. Delete this path from the line leaving only "shell=Explorer.exe". 5. Restart the computer. 6. Delete the file from the path noted in step 3. These instructions were tested for Infector versions 1.3, 1.4.1 and 1.4.2. For other possible versions of the Infector backdoor, you may want to use an antivirus program to remove the Infector backdoor: 1. If you do not have an antivirus program installed, download and install one of these virus scanners: ■ Norton AntiVirus: http://www.symantec.com/nav/indexA.html ■ McAfee VirusScan: http://software.mcafee.com/centers/download/ ■ Trend Micro PC-Cillin: http://www.trend.com/pc-cillin/ 2. Run the antivirus program to scan your system for this backdoor. The virus scanner should find and remove the Infector backdoor from your computer. References TL Security Web site Infector backdoor http://www.tlsecurity.net/backdoor/Infector.backdoor.html ISS X-Force Infector backdoor for Windows http://xforce.iss.net/static/5025.php 394 INN control message allows commands to be executed as root (INN_Control) INN control message allows commands to be executed as root (INN_Control) About this signature or vulnerability This signature detects an attack against the INN news server that allows any remote user that can propagate a message to the news server to execute arbitrary commands on the remote machine. False positives RealSecure Network Sensor: A false positive is possible if a control message embedded in a standard news message is detected. RealSecure Server Sensor: A false positive is possible if a control message embedded in a standard news message is detected. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 6.5 Systems affected InterNet News (INN) Type Unauthorized Access Attempt Vulnerability description A vulnerability has been identified in the InterNet News (INN) daemon that could allow a remote attacker to gain root access on vulnerable computers. This vulnerability affects all versions up to and including 1.5.1. A remote attacker can send a specially-crafted control message to the victim's news server to trick the process into executing arbitrary commands on the system with root privileges. Exploit information for this vulnerability has been made widely available. How to remove this vulnerability This problem affects all versions including and prior to 1.5.1. Upgrade to the latest version of INN (2.3.0 or later), available from the Internet Software Consortium Web site. See References. References CERT Summary CS-1997.02 Current activity - attacks on news servers http://www.cert.org/summaries/CS-97.02.html CERT Advisory CA-1997-08 Vulnerability in innd http://www.cert.org/advisories/CA-1997-08.html AUSCERT Advisory AA-96.19 INN parsecontrol Vulnerability ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-96.19.INN.parsecontrol.vul IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1997:002.1 Security vulnerability in "innd" (InterNetNews server) http://www-1.ibm.com/services/brs/brspwhub.nsf/advisories 395 INN buffer overflow attack allows users to execute arbitrary code (INN_Overflow) Internet Software Consortium (ISC) Web site INN Version 2.3.0 http://www.isc.org/products/INN/ BugTraq Mailing List, Wed Dec 04 1996 21:59:46 Re: ANNOUNCE: INN 1.5 http://www.securityfocus.com/archive/1/5855 ISS X-Force INN control message allows commands to be executed as root http://xforce.iss.net/static/184.php CVE CVE-1999-0100 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0100 INN buffer overflow attack allows users to execute arbitrary code (INN_Overflow) Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 6.5 Systems affected InterNet News (INN) Type Unauthorized Access Attempt Vulnerability description The NNTP (Network News Transfer Protocol) daemon distributed with INN (InterNetNews) 1.5 and earlier is vulnerable to a buffer overflow. By sending a speciallycrafted string to the NNTP daemon, an attacker can cause the process to execute arbitrary code on the INN server with root privileges. How to remove this vulnerability This particular problem was resolved in version 1.5.1, which was later found to have similar security problems. Upgrade to the latest version of INN (2.3.0 or later), available from the Internet Software Consortium Web site. See References. References Network Associates, Inc. COVERT Labs Security Advisory #17 Vulnerability in INN http://www.pgp.com/research/covert/advisories/017.asp Internet Software Consortium (ISC) Web site INN Version 2.3.0 http://www.isc.org/products/INN/ ISS X-Force INN buffer overflow attack allows users to execute arbitrary code http://xforce.iss.net/static/623.php 396 INN verifycancels option allows remote code execution (Innd_Cancel_Overflow) CVE CVE-1999-0247 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0247 INN verifycancels option allows remote code execution (Innd_Cancel_Overflow) About this signature or vulnerability This signature detects NNTP traffic that could overflow a buffer in the NNTP server code. Default risk level High Sensors that have this signature RealSecure Network Sensor: SR 1.1, RealSecure Server Sensor: 6.5 Systems affected InterNet News (INN): 2.0, InterNet News (INN): 2.1, InterNet News (INN): 2.2, InterNet News (INN): 2.2.1, InterNet News (INN): 2.2.2 Type Unauthorized Access Attempt Vulnerability description InterNet News (INN) is a popular, freely available NNTP (Network News Transfer Protocol) server for Unix platforms. INN versions 2.x and earlier are vulnerable to a buffer overflow in the INN code that verifies cancel requests sent to the control newsgroup. By posting a message with a long message ID, and then sending a cancel request message that contains a different sender than the original post, a remote attacker can overflow a buffer in the NNTP server code and execute arbitrary code on the system. This vulnerability exists when the "verifycancels" option is enabled in the innd.conf file, which is not the default setting except for some versions of Red Hat Linux. How to remove this vulnerability Upgrade to INN version 2.2.3, available from the Internet Software Consortium Web site. See References. For Linux-Mandrake: Apply the appropriate patch for your system, as listed in MandrakeSoft Security Advisory MDKSA-2000:023 : inn. See References. For Conectiva Linux: Set the INN "verifycancels" option to "false,” or upgrade to the latest version of Conectiva’s INN (2.2.2-3cl or later), as listed in Conectiva Linux security announcement inn. See References. References BugTraq Mailing List, Tue Jun 06 2000 10:18:44 innd 2.2.2 remote buffer overflow http://www.securityfocus.com/archive/1/63549 397 NetBSD unaligned IP options (IP_Unaligned_Timestamp) Linux-Mandrake Security Update Advisory MDKSA-2000:023 inn http://www.linux-mandrake.com/en/updates/2000/MDKSA-2000-023.php3?dis=6.0 BugTraq Mailing List, Tue Jun 06 2000 11:32:23 Conectiva Linux security announcement - inn http://www.securityfocus.com/archive/1/63877 Internet Software Consortium (ISC) Web site INN: InterNetNews http://www.isc.org/products/INN/ Caldera Systems, Inc. Security Advisory CSSA-2000-016.0 buffer overflow in inn http://www.calderasystems.com/support/security/advisories/CSSA-2000-016.0.txt ISS X-Force INN verifycancels option allows remote code execution http://xforce.iss.net/static/4615.php CVE CVE-2000-0472 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0472 NetBSD unaligned IP options (IP_Unaligned_Timestamp) About this signature or vulnerability This signature detects packets that have an unaligned timestamp option, which may indicate an attacker's attempts to crash the server. Default risk level Low Sensors that have this signature RealSecure Server Sensor: 6.0.1 Systems affected NetBSD: 1.4.1, FreeBSD: 3.4, FreeBSD: 4.0, NetBSD: 1.4.2, FreeBSD: 5.0 Type Denial of Service Vulnerability description Some BSD operating systems are vulnerable to a denial of service attack involving the kernel's IP stack. A remote attacker could send a packet that has an unaligned IP timestamp option to cause a kernel panic or other errors that could lead to a denial of service. How to remove this vulnerability Upgrade or patch your system, as recommended by your vendor. As a workaround, block incoming packets with the IP options using ipfw(8). For NetBSD 1.4.1 and 1.4.2: Apply the appropriate patch for your system, as listed in NetBSD Security Advisory 2000-002. See References. 398 Duplicate IP addresses (IPDuplicate) For FreeBSD: Upgrade to the latest version of FreeBSD (dated 2000-06-08 or later), as listed in FreeBSD Security Advisory FreeBSD-SA-00:23. See References. As an alternative, apply the ip_options patch, as listed in FreeBSD Security Advisory FreeBSD-SA-00:23. See References. References BugTraq Mailing List, Sat May 06 2000 03:19:29 [NHC20000504a.0: NetBSD Panics when sent unaligned IP options] http://www.securityfocus.com/archive/1/58867 NetBSD Security Advisory 2000-002 IP options processing Denial of Service ftp://ftp.netbsd.org/pub/NetBSD/misc/security/advisories/NetBSD-SA2000002.txt.asc FreeBSD, Inc. Security Advisory FreeBSD-SA-00:23 Remote denial-of-service in IP stack ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:23.ipoptions.asc.v1.1 ISS X-Force NetBSD unaligned IP options http://xforce.iss.net/static/4868.php CVE CVE-2000-0440 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0440 Duplicate IP addresses (IPDuplicate) About this signature or vulnerability This signature detects two or more computers on your network using the same IP address. The RealSecure Network Sensor will identify the MAC addresses that were detected. The first bits in the MAC address identify the type of device, such as SUN workstation, router, or ethernet card, which can help determine which type of computer is using the IP address. RealSecure Network Sensor detects the duplicate IP address by monitoring ARP packets and comparing the MAC address and IP addresses found in each packet. When it detects two packets with the same IP address address, but different MAC addresses, it creates this IPDuplicate event. The Network Sensor continues to create IPDuplicate events until the MAC and IP addresses of ARP packets match again. False positives RealSecure Network Sensor: Dual-homed routers (used for load-balancing) will trigger this signature. When a user replaces an adapter card, this signature will also be triggered. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure OS Sensor: 5.0, RealSecure Server Sensor: 5.5 399 IP fragmentation (IPFrag) Systems affected Any Type Suspicious Activity Vulnerability description Only one device on a network should send packets with a specific IP address. If a second device on the network starts to send packets claiming to have the same source address, a network problem has occurred. A device on the network may be misconfigured to have the same IP address as another device, causing network conflicts. It is also possible that a device on the network may be sending IP packets with a spoofed source address. How to remove this vulnerability Identify the hosts involved. You may need to use a network management tool, such as Network Monitor or Sniffer, to identify exactly which computers are using the duplicate IP addresses. If one of the addresses comes from outside your network, monitor the address in question to see what kind of data is being exchanged. Correct any inappropriate network card configuration issues, if necessary. If an attacker is spoofing IP addresses, determine how the attacker has gained access and take appropriate actions to resolve the situation. References ISS X-Force Duplicate IP addresses http://xforce.iss.net/static/406.php IP fragmentation (IPFrag) Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected Any Type Suspicious Activity Vulnerability description Fragmentation is a feature of the Internet Protocol (IP) suite that allows packets to be broken into smaller units to be transferred across networks that do not support larger MTUs (Message Transfer Units). An IP packet that is split into several fragments as it is transmitted over a network is reassembled at the destination to form a full IP packet. Some routers or firewalls only analyze the first fragment in a series to determine whether or not it should be passed. Subsequent, remaining fragments will be passed blindly. Subsequent fragments that overwrite the first fragment could reach a destination that the router or firewall intends to block. By using fragmentation in this way, an attacker can execute an attack beyond the filter or access control modules implemented in routers or packet filtering firewalls. It is possible for an attacker to construct individual fragments of an IP packet so that subsequent packets overlap. As a result, the fragments can overwrite parts of the TCP header when they are reassembled at the destination. In this case, an intermediate filtering router can be 400 TCP Half scan (Stealth scan) (IPHalfScan) tricked into believing that a packet is destined for an allowed service, when instead the packet is destined for a filtered service. How to remove this vulnerability Ensure that you are using the latest available versions for your routers and firewalls. Contact your vendors for upgrade or patch information. Consult the documentation for your routers and firewalls for more information on how they handle fragmentation. References Fermilab Linac Web site IP Fragmentation http://www-linac.fnal.gov/LINAC/software/locsys/syscode/ipsoftware/ IPFragmentation.html ISS X-Force IP fragmentation http://xforce.iss.net/static/407.php TCP Half scan (Stealth scan) (IPHalfScan) About this signature or vulnerability This signature detects one of the following types of stealth scans on your network: a NULL scan, a Christmas scan, or a SYN-FIN scan. False positives RealSecure Network Sensor: It is possible that a keep-alive timer for certain "internet push" technologies, as well as misbehaving or obsolete TCP implementations, may trigger this signature. RealSecure Server Sensor: It is possible that a keep-alive timer for certain "internet push" technologies, as well as misbehaving or obsolete TCP implementations, may trigger this signature. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected Any Type Pre-attack Probe Vulnerability description During a normal TCP connection, the source initiates the connection by sending a SYN packet to a port on the destination system. If a service is listening on that port, the service responds with a SYN/ACK packet. The client initiating the connection then responds with an ACK packet, and the connection is established. If the destination host is not waiting for a connection on the specified port, it responds with an RST packet. Most system logs do not log completed connections until the final ACK packet is received from the source. Sending other types of packets that do not follow this sequence can elicit useful responses from the target host, without causing a connection to be logged. This is known as a TCP 401 IPOP3D, brute force attack (IPOP3D_brute_force_attack) half scan, or a stealth scan, because it does not generate a log entry on the scanned host. An attacker can send several different type of packets to initiate various types of stealth scans, such as the following: ● NULL scan ● Christmas scan (SYN+FIN+ACK) ● SYN-FIN scan A stealth scan is dangerous because it allows an attacker to determine which ports are open on a target host, without being detected by the host operating system. How to remove this vulnerability Upgrade your firewall to a system that understands the state of TCP connections and rejects stealth scan packets. Stateful Inspections and Proxy firewalls will defeat IP half scan attacks. If you see this attack, log the address of the scanning entity. Contact the domain administrator of the source domain to verify the address and the intent behind the scan. Pay close attention to the log files of scanned hosts. If appropriate, reconfigure your firewalls to inhibit traffic from the source of the scans. References ISS X-Force TCP Half scan (Stealth scan) http://xforce.iss.net/static/405.php IPOP3D, brute force attack (IPOP3D_brute_force_attack) About this signature or vulnerability This signature detects the following syslog message generated by the IPOP3 service: "Excessive login failures" Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IPOP3D (Post Office Protocol) service has historically been targeted by attackers. This service records access attempts in the Unix syslog, as well as events that are associated with specific attacks. Certain direct attacks against the IPOP3D service can be detected in this way. It may also be helpful to create an audit history of successful and failed access events by monitoring the service's syslog messages. How to remove this vulnerability This event likely indicates a direct attack against the IPOP3D service, which requires immediate response from an administrator. Log in to the Unix host in question and terminate any user process that is obviously the source of the attack. Consider 402 IPOP3D, user auto-logout (IPOP3D_user_auto-logout) immediately shutting down the service and curtailing access. Investigate the need to upgrade or patch the service. References ISS X-Force IPOP3D, brute force attack http://xforce.iss.net/static/1522.php IPOP3D, Buffer overflow attack (IPOP3D_Overflow) About this signature or vulnerability This signature detects the following syslog message generated by the IPOP3 service: "Crack attempt" Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Unauthorized Access Attempt Vulnerability description The IPOP3D (Post Office Protocol) service has historically been targeted by attackers. This service records access attempts in the Unix syslog, as well as events that are associated with specific attacks. Certain direct attacks against the IPOP3D service can be detected in this way. It may also be helpful to create an audit history of successful and failed access events by monitoring the service's syslog messages. How to remove this vulnerability This event likely indicates a direct attack against the IPOP3D service, which requires immediate response from an administrator. Log in to the Unix host in question and terminate any user process that is obviously the source of the attack. Consider immediately shutting down the service and curtailing access. Investigate the need to upgrade or patch the service. References ISS X-Force IPOP3D, Buffer overflow attack http://xforce.iss.net/static/4918.php IPOP3D, user auto-logout (IPOP3D_user_auto-logout) About this signature or vulnerability This signature detects the following syslog message generated by the IPOP3 service: "Autologout user" Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0 403 IPOP3D, user kiss of death logout (IPOP3D_user_kiss_of_death_logout) Systems affected Unix Type Host Sensor Vulnerability description The IPOP3D (Post Office Protocol) service has historically been targeted by attackers. This service records access events in the Unix syslog. It may be helpful to create an audit history of these events, by monitoring the service's syslog messages. Normal access attempts at unexpected times or under unusual circumstances may reveal the presence of an attacker. How to remove this vulnerability This event is likely the result of normal user activity. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IPOP3D service has occurred. References ISS X-Force IPOP3D, user auto-logout http://xforce.iss.net/static/1524.php IPOP3D, user kiss of death logout (IPOP3D_user_kiss_of_death_logout) About this signature or vulnerability This signature detects the following syslog message generated by the IPOP3 service: "Kiss of death" Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IPOP3D (Post Office Protocol) service has historically been targeted by attackers. This service records access attempts in the Unix syslog, as well as events that are associated with specific attacks. Certain direct attacks against the IPOP3D service can be detected in this way. It may also be helpful to create an audit history of successful and failed access events by monitoring the service's syslog messages. How to remove this vulnerability This event likely indicates a direct attack against the IPOP3D service, which requires immediate response from an administrator. Log in to the Unix host in question and terminate any user process that is obviously the source of the attack. Consider immediately shutting down the service and curtailing access. Investigate the need to upgrade or patch the service. 404 IPOP3D, user login successful (IPOP3D_user_login_successful) References ISS X-Force IPOP3D, user kiss of death logout http://xforce.iss.net/static/1521.php IPOP3D, user login failure (IPOP3D_user_login_failure) About this signature or vulnerability This signature detects the following syslog message generated by the IPOP3 service: "Login failure" Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IPOP3D (Post Office Protocol) service has historically been targeted by attackers. This service records failed access events in the Unix syslog. It may be helpful to create an audit history of these events, by monitoring the service's syslog messages. Failed access attempts may indicate an access error or an attempt by an attacker to probe your network. How to remove this vulnerability This event may indicate that a user is having difficulty using the service, or it may indicate the presence of an attacker. Log in to the Unix host in question and determine who is accessing the service and if they have a legitimate reason to do so. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IPOP3D service has occurred. References ISS X-Force IPOP3D, user login failure http://xforce.iss.net/static/1523.php IPOP3D, user login successful (IPOP3D_user_login_successful) About this signature or vulnerability This signature detects the following syslog message generated by the IPOP3 service: "Login user=" Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix 405 IPOP3D user login to remote host successful (IPOP3D_user_login_to_remote_host_successful) Type Host Sensor Vulnerability description The IPOP3D (Post Office Protocol) service has historically been targeted by attackers. This service records access events in the Unix syslog. It may be helpful to create an audit history of these events, by monitoring the service's syslog messages. Normal access attempts at unexpected times or under unusual circumstances may reveal the presence of an attacker. How to remove this vulnerability This event is likely the result of normal user activity. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IPOP3D service has occurred. References ISS X-Force IPOP3D, user login successful http://xforce.iss.net/static/1560.php IPOP3D user login to remote host successful (IPOP3D_user_login_to_remote_host_successful) About this signature or vulnerability This signature detects the following syslog message generated by the IPOP3 service: "IMAP login to host" Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IPOP3D (Post Office Protocol) service has historically been targeted by attackers. This service records access events in the Unix syslog. It may be helpful to create an audit history of these events, by monitoring the service's syslog messages. Normal access attempts at unexpected times or under unusual circumstances may reveal the presence of an attacker. How to remove this vulnerability This event is likely the result of normal user activity. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IPOP3D service has occurred. References ISS X-Force IPOP3D user login to remote host successful http://xforce.iss.net/static/1559.php 406 TCP/IP protocol violations (IPProtocolViolation) IPOP3D, user logout (IPOP3D_user_logout) About this signature or vulnerability This signature detects the following syslog message generated by the IPOP3 service: "Logout from" Default risk level Low Sensors that have this signature RealSecure OS Sensor: 3.0 Systems affected Unix Type Host Sensor Vulnerability description The IPOP3D (Post Office Protocol) service has historically been targeted by attackers. This service records access events in the Unix syslog. It may be helpful to create an audit history of these events, by monitoring the service's syslog messages. Normal access attempts at unexpected times or under unusual circumstances may reveal the presence of an attacker. How to remove this vulnerability This event is likely the result of normal user activity. If this event appears suspicious, review the audit history of access to determine if misuse or an attack of the IPOP3D service has occurred. References ISS X-Force IPOP3D, user logout http://xforce.iss.net/static/1525.php TCP/IP protocol violations (IPProtocolViolation) About this signature or vulnerability Additional Vulnerabilities Found This signature detects invalid packets in TCP/IP traffic. ■ decod-lamptest-segment Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 2.5, RealSecure Server Sensor: 5.5 Systems affected Any Type Protocol Signature 407 Unknown IP protocol (IPUnknownProtocol) Vulnerability description Every network protocol has various rules that must be followed for proper operation. To ensure that certain rules are being followed, packets can be collected and examined. This can ensure that packets are valid. This can also ensure that the intrusion detection system examining the packets does not fail to properly interpret packets. Attackers may attempt to cause failures at the target host or cause an intrusion detection system to misinterpret traffic or fail. How to remove this vulnerability Examine the reason for the protocol violation given in the report. Check the source and destination addresses for other events that have been triggered. Protocol violations are most significant in conjunction with other attacks. References ISS X-Force TCP/IP protocol violations http://xforce.iss.net/static/1074.php Unknown IP protocol (IPUnknownProtocol) Default risk level Low Sensors that have this signature RealSecure Network Sensor: 2.5 Systems affected Any Type Suspicious Activity Vulnerability description There are several well-known protocols that are used on top of the IP protocol to transmit data. Examples of these are TCP, UDP, and IGMP. Custom applications may create their own protocol and transmit data using a custom protocol. These applications that use their own protocol format may make it difficult or impossible to determine what is being transmitted without directly examining the data. For this reason, custom protocols are sometimes used by attackers to avoid detection while transmitting data across the network. Many security tools ignore protocols they do not understand. Therefore, it is common to establish a covert communications channel using an unknown protocol. A covert channel could indicate a backdoor into your network. How to remove this vulnerability If you suspect abnormal activity, use a network analysis tool to capture and view network traffic. References ISS X-Force Unknown IP protocol http://xforce.iss.net/static/408.php 408 IRC channel joined (IRC_Join) IRC buffer overflow allows attackers to execute commands as root (IRC_Daemon_Overflow) About this signature or vulnerability This signature detects a buffer overflow attack against ircd, the server binary for Internet Relay Chat. Default risk level High Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected IRCd: 2.8.21 and earlier Type Unauthorized Access Attempt Vulnerability description The Internet Relay Chat (ICR) daemon, ircd, is vulnerable to a buffer overflow. A remote attacker can overflow a buffer and execute arbitrary code on the system to gain root access or cause the system to crash. Exploit information about this vulnerability has been made widely available. This buffer overflow vulnerability exists in all versions of ircd.dal through 4.4.10 and the base irc2.8.21 distribution. The vulnerability may be present in ircu2.9.32, though it is known to not be present in ircd.dal4.4.11. How to remove this vulnerability Upgrade to the latest version of ircd (2.9.1 or later), available from the Boston University FTP site. See References. References BugTraq Mailing List, Tue Jul 01 1997 02:20:47 ircd buffer overflow http://www.securityfocus.com/archive/1/7169 The Book of IRC Web site Software archive - IRC daemons http://www.bookofirc.com/software/servers/ Boston University FTP site ircd software downloads (v2.5.x - v2.9.x) ftp://cs-pub.bu.edu/pub/irc/servers/ ISS X-Force IRC buffer overflow allows attackers to execute commands as root http://xforce.iss.net/static/624.php IRC channel joined (IRC_Join) About this signature or vulnerability This signature detects channels joined by a user on Internet Relay Chat (IRC). In combination with the other IRC signatures, this signature can be used to construct a log of IRC activity. 409 IRC message (IRC_Msg) Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Internet Relay Chat Type Protocol Signature Vulnerability description Internet Relay Chat (IRC) has traditionally been used for on-line discussions. While many of IRC channels are used to discuss legitimate topics, some channels may be used to discuss illegal or unethical activities. How to remove this vulnerability Consult your organization's acceptable use policy and consider restricting use of IRC. References ISS X-Force IRC channel joined http://xforce.iss.net/static/660.php IRC message (IRC_Msg) About this signature or vulnerability This signature detects entire messages sent by a user on Internet Relay Chat (IRC). In combination with the other IRC signatures, this signature can be used to construct a log of IRC activity. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Internet Relay Chat Type Protocol Signature Vulnerability description Internet Relay Chat (IRC) has traditionally been used for on-line discussions. While many of IRC channels are used to discuss legitimate topics, some channels may be used to discuss illegal or unethical activities. How to remove this vulnerability Consult your organization's acceptable use policy and consider restricting use of IRC. References ISS X-Force IRC message http://xforce.iss.net/static/661.php 410 Trinity distributed denial of service tool (IRC_Trinity) IRC nick (IRC_Nick) About this signature or vulnerability This signature detects changes of a user's nickname on Internet Relay Chat (IRC). In combination with the other IRC signatures, this signature can be used to construct a log of IRC activity. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected IRCd: 2.8.21 and earlier Type Protocol Signature Vulnerability description Internet Relay Chat (IRC) has traditionally been used for on-line discussions. While many of IRC channels are used to discuss legitimate topics, some channels may be used to discuss illegal or unethical activities. How to remove this vulnerability Consult your organization's acceptable use policy and consider restricting use of IRC. References ISS X-Force IRC nick http://xforce.iss.net/static/662.php Trinity distributed denial of service tool (IRC_Trinity) About this signature or vulnerability This signature detects an IRC message that begins with "(trinity)". This could indicate the presence of a Trinity agent on a system on your network. False positives RealSecure Network Sensor: A false positive is possible if RealSecure detects any IRC user message that begins with "(trinity)". Default risk level High Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected Linux kernel Type Denial of Service Vulnerability description Trinity is a distributed denial of service tool for Linux that is controlled by IRC (Internet Relay Chat). The Trinity agent connects to an Undernet IRC server and waits for 411 IRDP can be used to change the default gateway of some systems (IRDP_Gateway_Spoof) commands to be sent to the channel. Trinity can perform 8 different types of floods: UDP flood, Fragment flood, SYN flood, RST flood, random flags flood, ACK flood, establish flood, and null flood. How to remove this vulnerability Reinstall the operating system of any system on which a Trinity agent is found. Consider restricting use of public chat systems, such as IRC, which can pose a legitimate security risk. References Internet Security Systems Security Alert #59 Trinity v3 Distributed Denial of Service tool http://xforce.iss.net/alerts/advise59.php CIAC Information Bulletin K-072 New Variants of Trinity and Stacheldraht DDoS http://www.ciac.org/ciac/bulletins/k-072.shtml ISS X-Force Trinity distributed denial of service tool http://xforce.iss.net/static/5256.php IRDP can be used to change the default gateway of some systems (IRDP_Gateway_Spoof) About this signature or vulnerability This signature detects an ICMP type 9 (router advertisement) packet with a router preference greater than or equal to 1000. Default risk level High Sensors that have this signature RealSecure Network Sensor: SR 1.1, RealSecure Server Sensor: 5.5.2 Systems affected Solaris, SunOS, Windows 95, Windows 98 Type Suspicious Activity Vulnerability description Systems configured for DHCP (Dynamic Host Configuration Protocol) obtain default gateway information and other configuration parameters when they first contact the network's DHCP server. When dynamically configured through DHCP, it is possible to remotely change the default gateway of certain systems (including Sun Solaris and SunOS as well as Windows 95 and Windows 98) with ICMP Router Advertisement messages. Using ICMP Router Advertisement messages in this way, an attacker could cause a system to direct its network traffic through a system of the attacker's choice. This could allow an attacker to use passive or man-in-the-middle monitoring, or commit denial of service attacks. How to remove this vulnerability Block all incoming ICMP type 9 and 10 (Router Advertisement and Solicitation) datagrams. 412 Internet Scanner or Desktop Protection System detected a high risk vulnerability (IS_High_Vulnerability_Found) For Windows 95/98: Disable IRDP functionality. Refer to Microsoft Knowledge Base Article Q216141. See References. For Solaris and SunOS: Configure your systems to obtain default gateway information from the DHCP server or from the '/etc/defaultrouter' file. Solaris Configure the system to obtain default gateway information from the DHCP server or from the '/etc/defaultrouter' file. SunOS Configure the system to obtain default gateway information from the DHCP server or from the '/etc/defaultrouter' file. Windows 95 Configure the system to disable IRDP functionality; refer to Microsoft Knowledge Base Article Q216141. Windows 98 Configure the system to disable IRDP functionality; refer to Microsoft Knowledge Base Article Q216141. References @stake, Inc./L0pht Security Advisory 08/11/99 IDRP Default Route Assignment http://www.atstake.com/research/advisories/1999/rdp.txt Microsoft Knowledge Base Article Q216141 HOWTO: Disable IRDP Automatically Using WSH VBScript http://support.microsoft.com/support/kb/articles/q216/1/41.asp ISS X-Force IRDP can be used to change the default gateway of some systems http://xforce.iss.net/static/3123.php CVE CVE-1999-0875 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0875 Internet Scanner or Desktop Protection System detected a high risk vulnerability (IS_High_Vulnerability_Found) About this signature or vulnerability This signature detects when Internet Scanner or Desktop Protection System detects a high risk vulnerability on a host. The scanner's policy determined that this event should be sent to the RealSecure Server Sensor. Default risk level High 413 Internet Scanner detected a low risk vulnerability (IS_Low_Vulnerability_Found) Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Windows NT, Windows 95, Windows 98, Windows 2000, Windows ME Type Host Sensor Vulnerability description Internet Scanner or Desktop Protection System detected a high risk vulnerability on a host. The policy determined that this event should be sent to the RealSecure Server Sensor. How to remove this vulnerability Identify the host for which the vulnerability was detected. Run a Desktop Protection System scan on the host with local reports enabled, or consult the Internet Scanner scan results, which will provide detailed information regarding the detected vulnerability as well as a specific remedy. References ISS X-Force Internet Scanner or Desktop Protection System detected a high risk vulnerability http://xforce.iss.net/static/6119.php Internet Scanner detected a low risk vulnerability (IS_Low_Vulnerability_Found) About this signature or vulnerability This signature detects when Internet Scanner detects a low risk vulnerability on a host. The Internet Scanner policy determined that this event should be sent to the RealSecure Server Sensor. Default risk level Low Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Windows, Unix Type Host Sensor Vulnerability description Internet Scanner detected a low risk vulnerability on a host. The Internet Scanner policy determined that this event should be sent to the RealSecure Server Sensor. How to remove this vulnerability Identify the host for which the vulnerability was detected. Consult the Internet Scanner scan results, which will provide detailed information regarding the detected vulnerability as well as a specific remedy. References ISS X-Force Internet Scanner detected a low risk vulnerability http://xforce.iss.net/static/7227.php 414 Internet Scanner scan completed (IS_Scan_Completed) Internet Scanner detected a medium risk vulnerability (IS_Meduim_Vulnerability_Found) About this signature or vulnerability This signature detects when Internet Scanner detects a medium risk vulnerability on a host. The Internet Scanner policy determined that this event should be sent to the RealSecure Server Sensor. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Windows, Unix Type Host Sensor Vulnerability description Internet Scanner detected a medium risk vulnerability on a host. The Internet Scanner policy determined that this event should be sent to the RealSecure Server Sensor. How to remove this vulnerability Identify the host for which the vulnerability was detected. Consult the Internet Scanner scan results, which will provide detailed information regarding the detected vulnerability as well as a specific remedy. References ISS X-Force Internet Scanner detected a medium risk vulnerability http://xforce.iss.net/static/7226.php Internet Scanner scan completed (IS_Scan_Completed) About this signature or vulnerability This signature detects a Windows Application event log message or a Solaris syslog message indicating that an Internet Scanner scan has completed. Default risk level Low Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Windows, Unix Type Host Sensor Vulnerability description An Internet Scanner scan was completed. This means that Internet Scanner has finished either a manual scan or a scheduled scan. Use this event to keep track of when scans are performed. 415 ISA Server component failed (ISA_Abnormal_Termination) How to remove this vulnerability Confirm that the scan is authorized. If the scan is not authorized, ensure that access to the Internet Scanner console is secure and protected from unauthorized users. References ISS X-Force Internet Scanner scan completed http://xforce.iss.net/static/7229.php Internet Scanner scan started (IS_Scan_Started) About this signature or vulnerability This signature detects a Windows Application event log message or a Solaris syslog message indicating that Internet Scanner has started a scan. Default risk level Low Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Windows, Unix Type Host Sensor Vulnerability description An Internet Scanner scan was started. This means that Internet Scanner has started either a manual scan or a scheduled scan. Use this event to keep track of when scans are performed. How to remove this vulnerability Confirm that the scan is authorized. If the scan is not authorized, ensure that access to the Internet Scanner console is secure and protected from unauthorized users. References ISS X-Force Internet Scanner scan started http://xforce.iss.net/static/7228.php ISA Server component failed (ISA_Abnormal_Termination) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 7023 is written to the System event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor 416 ISA Server failed to start (ISA_Failed_To_Start) Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the System event log. An ISA Server component failed abnormally. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server component failed http://xforce.iss.net/static/7503.php ISA Alert service failed to log an event (ISA_Alert_Failed_Log) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14180 is written to the Application event log. See your ISA Server documentation for more details. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server Alert Service failed to log an event to the system log. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Alert service failed to log an event http://xforce.iss.net/static/7504.php ISA Server failed to start (ISA_Failed_To_Start) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 7001 is written to the System event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 417 ISA Firewall service failed to start (ISA_FW_Start_Failed_Corrupt) Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the System event log. The ISA Server failed to start successfully. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server failed to start http://xforce.iss.net/static/7505.php ISA Firewall service initialization failed (ISA_FW_Init_Failed) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14001 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server Firewall Service initialization failed. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Firewall service initialization failed http://xforce.iss.net/static/7506.php ISA Firewall service failed to start (ISA_FW_Start_Failed_Corrupt) About this signature or vulnerability 418 This signature detects when an ISA Server entry with event log ID 14063 is written to the Application event log. See your ISA Server documentation for more details. ISA Firewall service stopped (ISA_FW_Stop) Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server Firewall Service failed to start successfully. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Firewall service failed to start http://xforce.iss.net/static/7507.php ISA Firewall service stopped (ISA_FW_Stop) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14182 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server Firewall Service was stopped. Network security has been negatively impacted. How to remove this vulnerability Confirm with the system administrator that this is expected. If not, your system has likely been compromised. This event was generated directly from ISA server. Please see your ISA documentation for additional information. References ISS X-Force ISA Firewall service stopped http://xforce.iss.net/static/7508.php 419 ISA Server stopped logging events (ISA_LOG_Service_Stopped_Logging_Failure) ISA Server failed to write an event to the log (ISA_LOG_File_Write_Failed) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14047 is written to the Application event log. See your ISA Server documentation for more details. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server failed to write an event to the log file. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server failed to write an event to the log http://xforce.iss.net/static/7509.php ISA Server stopped logging events (ISA_LOG_Service_Stopped_Logging_Failure) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14049 is written to the Application event log. See your ISA Server documentation for more details. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The Microsoft ISA Service has stopped logging events to the log file. 420 ISA Server packet filter rebind failure (ISA_PF_Dial_Out_Rebind_Failure) How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server stopped logging events http://xforce.iss.net/static/7510.php ISA Server failed to create a packet filter (ISA_PF_Create_PF_Failure) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14120 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server could not create a packet filter. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server failed to create a packet filter http://xforce.iss.net/static/7511.php ISA Server packet filter rebind failure (ISA_PF_Dial_Out_Rebind_Failure) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14121 is written to the Application event log. See your ISA Server documentation for more details. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 421 ISA Server packet filters disabled (ISA_PF_Filtering_Disabled) Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server packet filter dial-out interface cannot be rebound. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server packet filter rebind failure http://xforce.iss.net/static/7512.php ISA Server packet filter is dropping packets (ISA_PF_Dropping_Packets) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14044 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server packet filter is dropping packets. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server packet filter is dropping packets http://xforce.iss.net/static/7513.php ISA Server packet filters disabled (ISA_PF_Filtering_Disabled) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14124 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High 422 ISA Server packet filter insecure configuration (ISA_PF_Insecure_Config) Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. ISA Server's packet filtering capability has been disabled. How to remove this vulnerability Confirm with the system administrator that this is expected. If not, your system has likely been compromised. This event was generated directly from ISA server. Please see your ISA documentation for additional information. References ISS X-Force ISA Server packet filters disabled http://xforce.iss.net/static/7514.php ISA Server packet filter insecure configuration (ISA_PF_Insecure_Config) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14086 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. ISA Server has detected an insecure configuration in the packet filter. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server packet filter insecure configuration http://xforce.iss.net/static/7515.php 423 ISA Server failed to create an IP packet filter (ISA_PF_IP_PF_Create_Failure) ISA Server packet filter interface bind failure (ISA_PF_Interface_Bind_Failure) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14122 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. An ISA Server packet filter interface cannot be bound. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server packet filter interface bind failure http://xforce.iss.net/static/7516.php ISA Server failed to create an IP packet filter (ISA_PF_IP_PF_Create_Failure) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14123 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. ISA Server failed to create an IP packet filter. 424 ISA Server packet filter protocol violation detected (ISA_PF_Protocol_Violation) How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server failed to create an IP packet filter http://xforce.iss.net/static/7517.php ISA Server packet filter did not detect an external interface (ISA_PF_No_Ext_Interface) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14119 is written to the Application event log. See your ISA Server documentation for more details. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. ISA Server did not detect an external interface for use by the packet filter. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server packet filter did not detect an external interface http://xforce.iss.net/static/7518.php ISA Server packet filter protocol violation detected (ISA_PF_Protocol_Violation) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14046 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 425 ISA Server Control service stopped (ISA_SCS_Stop) Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. ISA Server packet filter has detected a protocol violation. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server packet filter protocol violation detected http://xforce.iss.net/static/7519.php ISA Server Control service initialization failed (ISA_SCS_Init_Failed) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14026 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server Control Service failed to initialize due to an unknown reason. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server Control service initialization failed http://xforce.iss.net/static/7520.php ISA Server Control service stopped (ISA_SCS_Stop) About this signature or vulnerability 426 This signature detects when an ISA Server entry with event log ID 14181 is written to the Application event log. See your ISA Server documentation for more details. ISA Server corrupted registry (ISA_Server_Init_Failed_Corrupt) Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server Control Service was stopped. All other ISA services depend on the Server Control Service, so ISA has been effectively stopped. How to remove this vulnerability Confirm with the system administrator that this action was expected. If not, your system has likely been compromised. This event was generated directly from ISA server. Please see your ISA documentation for additional information. References ISS X-Force ISA Server Control service stopped http://xforce.iss.net/static/7521.php ISA Server corrupted registry (ISA_Server_Init_Failed_Corrupt) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14145 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. ISA Server failed to initialize because of a corrupted registry. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server corrupted registry http://xforce.iss.net/static/7522.php 427 ISA Web Proxy service stopped (ISA_WPS_Stop) ISA Server insecure configuration (ISA_Server_NAT_Insecure) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14087 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. ISA Server detected an insecure configuration. ISA uses its own NAT editor to fully secure your system. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Server insecure configuration http://xforce.iss.net/static/7523.php ISA Web Proxy service stopped (ISA_WPS_Stop) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 14183 is written to the Application event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the Application event log. The ISA Server Web Proxy Service has been stopped. How to remove this vulnerability Confirm with system administrators that this action was expected. If not, your system has likely been compromised. 428 Internet Scanner vulnerability assessment (ISS) This event was generated directly from ISA server. Please see your ISA documentation for additional information. References ISS X-Force ISA Web Proxy service stopped http://xforce.iss.net/static/7524.php ISA Web Proxy service failed (ISA_WPS_Terminated) About this signature or vulnerability This signature detects when an ISA Server entry with event log ID 7024 is written to the System event log. See your ISA Server documentation for more details. Default risk level High Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft ISA Server: 2000 Type Host Sensor Vulnerability description Microsoft ISA (Internet Security & Acceleration) Server has written a message to the System event log. The ISA Server Web Proxy Service terminated abnormally. How to remove this vulnerability This event was generated directly from ISA server. Please see your ISA documentation for remedy information. References ISS X-Force ISA Web Proxy service failed http://xforce.iss.net/static/7525.php Internet Scanner vulnerability assessment (ISS) About this signature or vulnerability This signature detects vulnerability assessments being made with the freely available version of Internet Scanner, or with the commercial version of the product made by Internet Security Systems (ISS). Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0, RealSecure Server Sensor: 5.5 Systems affected Any Type Pre-attack Probe 429 IP fragment reassembly denial of service (Jolt2) Vulnerability description The shareware version of Internet Scanner was widely distributed on the Internet. This product can identify weaknesses in networks connected to the Internet. By using the shareware version of Internet Scanner, an attacker could gain information that would be useful in performing an attack. How to remove this vulnerability No remedy available. Examine the source of the scan. If the scan comes from inside your organization or uses your own Internet Scanner key, then you may not need to worry. If it comes from outside or uses a key you do not recognize or uses an earlier shareware version of Internet Scanner, then you should identify the scanning entity and determine the intent of the scan. References CERT Advisory CA-1993-14 Internet Security Scanner (ISS) http://www.cert.org/advisories/CA-1993-14.html ISS X-Force Internet Scanner vulnerability assessment http://xforce.iss.net/static/632.php IP fragment reassembly denial of service (Jolt2) About this signature or vulnerability This signature detects very large ICMP packet fragments with an ID field and a fragment offset that are characteristic of the Jolt2 ping of death exploit. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.0.1 Systems affected Windows NT, Windows 95, Windows NT: 4.0, Windows 98, Windows 2000, BeOS: 5.0 Type Denial of Service Vulnerability description Windows 95, 98, NT, and 2000, as well as BeOS 5.0, are vulnerable to a denial of service attack, caused by a flaw in each operating system's method of IP fragment reassembly. A remote attacker could send a continuous stream of identical, fragmented IP packets to consume most or all of the operating system's CPU resources. This attack is sometimes called the Jolt2 attack. How to remove this vulnerability Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS00-029. See References. Windows NT Apply the "IP Fragment Reassembly" patch detailed in Microsoft Security Bulletin MS00029 430 Kerberos IV peek accesses usernames and information (Kerberos_User_Snarf) Windows 2000 Apply the "IP Fragment Reassembly" patch detailed in Microsoft Security Bulletin MS00029 References Microsoft Security Bulletin MS00-029 Patch Available for 'IP Fragment Reassembly' Vulnerability http://www.microsoft.com/technet/security/bulletin/ms00-029.asp BindView RAZOR Security Advisory, May 19, 2000 Jolt2 - Remote Denial of Service attack against Windows 2000, NT4, and Win9x http://razor.bindview.com/publish/advisories/adv_Jolt2.html Microsoft Knowledge Base Article Q259728 Windows Hangs with Fragmented IP Datagrams http://www.microsoft.com/technet/support/kb.asp?ID=259728 BugTraq Mailing List, Fri May 26 2000 09:18:38 Addendum: Analysis of jolt2.c (MS00-029) http://www.securityfocus.com/archive/1/62014 BugTraq Mailing List, Fri May 26 2000 07:18:13 Analysis of jolt2.c (MS00-029) http://www.securityfocus.com/archive/1/62011 ISS X-Force IP fragment reassembly denial of service http://xforce.iss.net/static/4518.php CVE CVE-2000-0305 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0305 Kerberos IV peek accesses usernames and information (Kerberos_User_Snarf) About this signature or vulnerability This signature detects a malformed packet sent to the Kerberos IV Key Distribution Center (KDC), which may indicate an attempt by an attacker to obtain usernames or other security-sensitive information from the KDC. False positives RealSecure Network Sensor: A false positive is possible for legitimate DNS requests from a Unix system. A false positive is also possible if a normal Kerberos error message is detected. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected Kerberos: IV 431 Kuang2 Virus installs remote control functionality on infected systems (Kuang2Virus) Type Pre-attack Probe Vulnerability description The Kerberos IV Key Distribution Center (KDC) does not clear some internal buffers. By sending a malformed packet to the KDC, an attacker can cause it to leak the username of the last request, as well as other information. By sending multiple malformed packets and analyzing the results of each, the attacker can obtain a list of usernames. This information could be useful to an attacker in performing future attacks. How to remove this vulnerability Upgrade to Kerberos V, or contact your vendor for patch availability for Kerberos IV. References @stake, Inc./L0pht Security Advisory 11/22/96 Kerberos 4 http://www.atstake.com/research/advisories/1996/krb_adv.txt Massachusetts Institute of Technology Web site Kerberos: The Network Authentication Protocol http://web.mit.edu/kerberos/www/ BugTraq Mailing List, Nov 22 1996 2:07AM L0pht Kerberos Advisory http://www.securityfocus.com/cgi-bin/archive.pl?id=1&mid=5747 ISS X-Force Kerberos IV peek accesses usernames and information http://xforce.iss.net/static/65.php CVE CAN-1999-1099 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1099 Kuang2 Virus installs remote control functionality on infected systems (Kuang2Virus) About this signature or vulnerability This signature detects traffic consistent with that produced by client commmunication with the Kuang2 Virus backdoor program. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.1 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description Kuang2 Virus is a backdoor program designed to run on Windows 95 and 98 systems that infects files much like a virus. Once the virus has been executed on a system, it allows 432 Land denial of service (Land) remote control of the system over TCP port 17300 and systematically infects all PE (Portable Executable) .exe files on the system. Remote attackers are able to download and upload files as well as install plugins that expand on the backdoor's basic functions. How to remove this vulnerability The client program includes an antivirus function to clean an infected computer. To clean the local system, leave the IP address field in the program blank. The antivirus cleaning process copies the infected version of EXPLORER.EXE to EXPLORER.WK2, and removes the virus. The program places the cleaned version of the file back to EXPLORER.EXE, when you shut down and restart your computer. The antivirus process also scans the hard drive, looking for any other infected files. The readme file included in the distribution of the backdoor recommends running the antivirus scan twice to ensure that the backdoor is removed. References McAfee Virus Profile W95/Kuang2.cli http://vil.mcafee.com/dispVirus.asp?virus_k=10213& TL Security Trojan Archive Kuang 2 The Virus http://www.multimania.com/ilikeit/kuang2v.htm ISS X-Force Kuang2 Virus installs remote control functionality on infected systems http://xforce.iss.net/static/4074.php Land denial of service (Land) About this signature or vulnerability Additional Vulnerabilities Found This signature detect a forged TCP SYN packet that has the IP address and port number for the source the same as the IP address and port for the destination, commonly known as the Land attack. ■ ver-tcpip-sys ■ 95-verv-tcp ■ cisco-land Default risk level Low Sensors that have this signature RealSecure Network Sensor: 2.0, RealSecure Server Sensor: 5.5 Systems affected Any, Windows NT, SCO Open Desktop/Open Server: 3.0, FreeBSD, SCO Open Server: 5.0, SCO UnixWare: 2.1.0, SCO CMW+: 3.0 Type Denial of Service Vulnerability description A Land attack, named after the published exploit of that name, is an attack in which a forged TCP SYN packet that has identical source and destination IP addresses, and identical source and destination port numbers, is sent to a target system. Receiving such a 433 Land denial of service (Land) packet causes some TCP implementations to crash the target system or exhaust all CPU resources. How to remove this vulnerability Apply router or firewall rules for all incoming packets claiming to originate from the internal network. — AND — Apply the latest Service Pack (SP4 or later) for Windows NT, available from the Microsoft Web site. See References. — OR — Apply the Service Pack 3 (SP3 or later) for Windows NT 4.0, available from the Microsoft Knowledge Base Article Q179129. See References. — OR — Apply the post-SP3 teardrop2-fix, available from the Microsoft Knowledge Base Article Q179129. See References. This fix applies only to those users who choose not to upgrade to SP4 or later. For FreeBSD-current: Apply the patch dated 1998-01-21, as listed in FreeBSD, Inc. Security Advisory FreeBSDSA-98:01. See References. For FreeBSD 2.2-stable: Apply the patch dated 1998-01-30, as listed in FreeBSD, Inc. Security Advisory FreeBSDSA-98:01. See References. Apply the appropriate patch for your system, as listed in SCO Security Bulletin 98:01. See References. For HP-UX: Apply the appropriate patch for your system, as listed in Hewlett-Packard Security Bulletin HPSBUX9801-076. See References. For Novell NetWare: Apply the ftcpsv09.exe (or later), and modify the STARTUP.NCF file to block these type of attacks, as listed in Novell Technical Information Document #2932511. See References. As a workaround, block IP-spoofed packets. For other distributions: Contact your vendor for upgrade or patch information. Windows NT Install the latest Windows NT 4.0 Servive Pack or, for Windows NT 4.0 Service Pack 3 (SP3) users, apply the teardrop2-fix hotfix as described in the Microsoft Knowledge Base (KB) article Q165005 "Windows NT Slows Down Because of Land Attack". SCO Open Desktop/Open Server: 3.0 Refer to SCO Security Bulletin 98:01 listed in the references. 434 Land denial of service (Land) FreeBSD For FreeBSD-current: Apply the patch dated 1998-01-21, as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-98:01. See References. For FreeBSD 2.2-stable: Apply the patch dated 1998-01-30, as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-98:01. See References. SCO Open Server: 5.0 Refer to SCO Security Bulletin 98:01 listed in the references. For OpenServer 5.0.0 and OpenServer 5.0.2, SLS OSS468 will include fixes. If OSS468 is installed, SSE010 is not required. SSE010 should not be installed after OSS468 as it will nullify other fixes contained in OSS468. For OpenServer 5.0.4, SLS OSS469 will include fixes. If OSS469 is installed, SSE010 is not required. SSE010 should not be installed after OSS469 as it will nullify other fixes contained in OSS469. SCO UnixWare: 2.1.0 Refer to SCO Security Bulletin 98:01 listed in the references. SCO CMW+: 3.0 Refer to SCO Security Bulletin 98:01 listed in the references. References Microsoft Knowledge Base Article Q179129 STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack http://support.microsoft.com/support/kb/articles/q179/1/29.asp Microsoft Knowledge Base Article Q165005 Windows NT Slows Down Because of Land Attack http://support.microsoft.com/support/kb/articles/q165/0/05.asp SCO Security Bulletin 98:01 IP-based Denial of Service Attacks ftp://ftp.sco.com/SSE/security_bulletins/SB.98:01a Hewlett-Packard Security Bulletin HPSBUX9801-076 (from SecurityFocus Archive) Security Vulnerability with land on HP-UX http://www.securityfocus.com/advisories/1481 CERT Advisory CA-1997-28 IP Denial-of-Service Attacks http://www.cert.org/advisories/CA-1997-28.html FreeBSD, Inc. Security Advisory FreeBSD-SA-98:01 LAND attack can cause harm to running FreeBSD systems ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-98:01.land.asc Novell Technical Information Document #2932511 TCP Loopback Denial-of-Service Attack http://support.novell.com/cgi-bin/search/tidfinder.cgi?2932511 Microsoft Web site Windows NT Service Packs http://support.microsoft.com/support/ntserver/Content/ServicePacks/ 435 Windows NT snork attack can disable system (Land_UDP) CIAC Information Bulletin I-036 FreeBSD Denial-of-Service LAND Attacks http://ciac.llnl.gov/ciac/bulletins/i-036.shtml CIAC Information Bulletin I-019 Tools Generating IP Denial-of-Service Attacks http://ciac.llnl.gov/ciac/bulletins/i-019.shtml CIAC Information Bulletin I-027b HP-UX Vulnerabilities (CUE, CDE, land) http://www.ciac.org/ciac/bulletins/i-027b.shtml ISS X-Force Land denial of service http://xforce.iss.net/static/288.php CVE CVE-1999-0016 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0016 Windows NT snork attack can disable system (Land_UDP) Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.2, RealSecure Server Sensor: 6.5 Systems affected Windows NT: 4.0, Windows NT: 4.0 SP2, Windows NT: 4.0 SP1, Windows NT: 4.0 SP3 Type Denial of Service Vulnerability description Windows NT 4.0 up to SP4 is vulnerable to a denial of service attack. A remote attacker with minimal resources can cause the system to consume all available processor and network bandwidth resources for an indefinite length of time. The attack induces a storm of packets much like the smurf and fraggle attacks that has been referred to as the snork attack. How to remove this vulnerability Apply the Windows NT 4.0 Service Pack 4 (SP4 or later), as listed in Microsoft Security Bulletin MS98-014. — OR — Apply the Snk-fix post-SP3 hotfix, as listed in Microsoft Security Bulletin MS98-014. See References. References Microsoft Security Bulletin MS98-014 Update available for RPC Spoofing Denial of Service on Windows NT http://www.microsoft.com/technet/security/bulletin/ms98-014.asp 436 Microsoft LDAP server permanent blacklist (LDAP_blacklist_permanent) Internet Security Systems Security Alert #09 Snork Denial of Service Attack Against Windows NT RPC Service http://xforce.iss.net/alerts/advise9.php Microsoft Knowledge Base Article Q193233 Rpcss.exe Consumes 100% CPU Due to RPC Spoofing Attack http://support.microsoft.com/support/kb/articles/q193/2/33.asp ISS X-Force Windows NT snork attack can disable system http://xforce.iss.net/static/1372.php CVE CVE-1999-0969 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0969 Microsoft LDAP server blacklist failed (LDAP_blacklist_failed) About this signature or vulnerability This signature detects a Windows security log message indicating that the Microsoft LDAP server has attempted and failed to place a misbehaving host on its permanent blacklist. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description An absence of frequent failures logged to the blacklist may indicate a misconfigured LDAP Server, misconfigured host, or user error. How to remove this vulnerability Examine the LDAP server and determine why it is failing to log the hosts in its blacklist. References ISS X-Force Microsoft LDAP server blacklist failed http://xforce.iss.net/static/3196.php Microsoft LDAP server permanent blacklist (LDAP_blacklist_permanent) About this signature or vulnerability This signature detects a Windows security log message indicating that the Microsoft LDAP server has placed a misbehaving host on its permanent blacklist. 437 Microsoft LDAP server temporary blacklist (LDAP_blacklist_short-term) Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description Permanent blacklisting may either be the result of a misconfigured device on the network, a blacklisting threshold that is set too low, or unauthorized activity. How to remove this vulnerability Identify the devices that are being blacklisted and determine why they are being blacklisted. If the devices are outside of your network and are not required for proper functioning, consider implementing firewall rules to prevent these systems from abusing the LDAP server. References ISS X-Force Microsoft LDAP server permanent blacklist http://xforce.iss.net/static/3195.php Microsoft LDAP server temporary blacklist (LDAP_blacklist_short-term) About this signature or vulnerability This signature detects a Windows security log message indicating that the Microsoft LDAP server has placed a misbehaving host on its temporary blacklist. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description Frequent activity in the blacklist may be caused by inappropriate or unauthorized activity in conjunction with the LDAP server. An absence of frequent failures logged to the blacklist may indicate a misconfigured host or user error. How to remove this vulnerability Identify the devices that are being blacklisted and determine why they are being blacklisted. If the devices are outside of your network and are not required for proper functioning, consider implementing firewall rules to prevent these systems from abusing the LDAP server. 438 Local group access or privileges modified (Local_group_changed) References ISS X-Force Microsoft LDAP server temporary blacklist http://xforce.iss.net/static/3194.php Local group access or privileges modified (Local_group_changed) About this signature or vulnerability This signature detects a security log message indicating that access to or privileges for a local group have been changed. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Unix, Windows NT Type Host Sensor Vulnerability description Local groups are the primary means for distributing important privileges among users. Groups help to simplify administration, as it is easier to assign privileges to a single group than assigning them to each individual member. An attacker that has gained access to a system can alter the membership of a local group to grant accounts privileges that were never intended by the administrator. Windows NT/2000: The following entry was added to the Windows NT/2000 security event log: "641 - Local group changed, success audit". A local group is a named collection of local and domain user accounts and global groups. It is a group that is defined on an individual computer. The predefined local groups for a Windows NT/2000 domain are Administrators, Backup Operators, Guests, Power Users, Replicator, and Users. The additional predefined local groups for a system setup as a domain controller are Account Operators, Print Operators, and Server Operators. Any time management is performed on the local group it will result in an audit message being written to the security event log. Solaris: The /etc/group file has been modified. A UNIX group is a named collection of user accounts. The local group file is in the file /etc/group. When a user is a member of a group they are entitled access files and other objects by virtue of their group ID (GID). Note that this event pertains specifically to the local group file. Group membership may also be provided to the system from a remote host via NIS. How to remove this vulnerability Windows NT/2000: If it has been determined that a system has been compromised, an inspection of the local group audit events can determine how broadly the attacker may have spread privileges among compromised accounts. You can review the administrative activity history by running the Windows NT/2000 Admin Activity Report. 439 Local group created with assigned members and privileges (Local_group_created) Solaris: Modification of the group file should only occur when account administration is being performed. If this event occurs and cannot be attributed to known administrative work, then check the contents of the group file for inappropriate use. References ISS X-Force Local group access or privileges modified http://xforce.iss.net/static/1535.php Local group created with assigned members and privileges (Local_group_created) About this signature or vulnerability This signature detects a Windows security log message indicating that a local group has been created. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A local group is a named collection of local and domain user accounts and global groups. It is a group that is defined on an individual computer. The predefined local groups for a Windows NT domain are Administrators, Backup Operators, Guests, Power Users, Replicator, and Users. The additional predefined local groups for a system setup as a domain controller are Account Operators, Print Operators, and Server Operators. Any management performed on the local group will result in an audit message being written to the security event log. Local groups are the primary means for distributing important privileges among users. Groups help to simplify administration, as it is easier to assign privileges to a single group than assigning them to each individual member. An attacker that has gained access to a system can alter the membership of a local group to grant accounts privileges that were never intended by the administrator. How to remove this vulnerability If it has been determined that a system has been compromised, an inspection of the local group audit events can determine the privileges and access rights that an attacker may have acquired. You can review the administrative activity history by running the Windows NT Admin Activity Report. References ISS X-Force Local group created with assigned members and privileges http://xforce.iss.net/static/1531.php 440 Local group membership modified - user added (Local_group_user_added) Local group deleted from the system (Local_group_deleted) About this signature or vulnerability This signature detects a Windows security log message indicating that a local group has been deleted. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A local group is a named collection of local and domain user accounts and global groups. It is a group that is defined on an individual computer. The predefined local groups for a Windows NT domain are Administrators, Backup Operators, Guests, Power Users, Replicator, and Users. The additional predefined local groups for a system setup as a domain controller are Account Operators, Print Operators, and Server Operators. Any management performed on the local group will result in an audit message being written to the security event log. Local groups are the primary means for distributing important privileges among users. Groups help to simplify administration, as it is easier to assign privileges to a single group than assigning them to each individual member. An attacker that has gained access to a system can alter the membership of a local group to grant accounts privileges that were never intended by the administrator. How to remove this vulnerability If it has been determined that a system has been compromised, an inspection of the local group audit events can determine the privileges and access rights that an attacker may have acquired. You can review the administrative activity history by running the Windows NT Admin Activity Report. References ISS X-Force Local group deleted from the system http://xforce.iss.net/static/1538.php Local group membership modified - user added (Local_group_user_added) About this signature or vulnerability This signature detects a Windows security log message indicating that a user has been added to a local group. Default risk level Medium 441 Local group membership modified - user removed (Local_group_user_removed) Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A local group is a named collection of local and domain user accounts and global groups. It is a group that is defined on an individual computer. The predefined local groups for a Windows NT domain are Administrators, Backup Operators, Guests, Power Users, Replicator, and Users. The additional predefined local groups for a system setup as a domain controller are Account Operators, Print Operators, and Server Operators. Any management performed on the local group will result in an audit message being written to the security event log. Local groups are the primary means for distributing important privileges among users. Groups help to simplify administration, as it is easier to assign privileges to a single group than assigning them to each individual member. An attacker that has gained access to a system can alter the membership of a local group to grant accounts privileges that were never intended by the administrator. How to remove this vulnerability If it has been determined that a system has been compromised, an inspection of the local group audit events can determine the privileges and access rights that an attacker may have acquired. You can review the administrative activity history by running the Windows NT Admin Activity Report. References ISS X-Force Local group membership modified - user added http://xforce.iss.net/static/1552.php Local group membership modified - user removed (Local_group_user_removed) About this signature or vulnerability This signature detects a Windows security log message indicating that a user has been removed from a local group. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A local group is a named collection of local and domain user accounts and global groups. It is a group that is defined on an individual computer. The predefined local groups for a Windows NT domain are Administrators, Backup Operators, Guests, Power Users, Replicator, and Users. The additional predefined local groups for a system setup as a 442 Windows 2000 account logon failed (Log_on_to_account_failed) domain controller are Account Operators, Print Operators, and Server Operators. Any management performed on the local group will result in an audit message being written to the security event log. Local groups are the primary means for distributing important privileges among users. Groups help to simplify administration, as it is easier to assign privileges to a single group than assigning them to each individual member. An attacker that has gained access to a system can alter the membership of a local group to grant accounts privileges that were never intended by the administrator. How to remove this vulnerability If it has been determined that a system has been compromised, an inspection of the local group audit events can determine the privileges and access rights that an attacker may have acquired. You can review the administrative activity history by running the Windows NT Admin Activity Report. References ISS X-Force Local group membership modified - user removed http://xforce.iss.net/static/1554.php Windows 2000 account logon failed (Log_on_to_account_failed) About this signature or vulnerability This signature detects a Windows event log message indicating that a logon to an account from a workstation has failed. Default risk level Low Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Windows 2000 Type Host Sensor Vulnerability description Logon failure from a workstation is a security sensitive event. Frequent logon failures, or attempts to log on using an inappropriate account could indicate attempts by an attacker to tamper with the Windows 2000 computer. How to remove this vulnerability Determine the cause of the logon failure. Review the error code associated with this event. Determine if the account in question is authorized for logon. References ISS X-Force Windows 2000 account logon failed http://xforce.iss.net/static/4872.php 443 Logon event by user with administrative privileges (Logon_with_admin_privileges) Logon process registered (Logon_process_registered) About this signature or vulnerability This signature detects that a trusted logon process has registered with the Local Security Authority (LSA) after system startup. This logon process will be trusted to submit logon requests. Usually, RealSecure will not detect the logon process registration at system startup, but it will detect those that register after RealSecure has started. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.1, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A trusted logon process has registered with the Local Security Authority (LSA). This logon process will be trusted to submit logon requests. A logon process is responsible for submitting the user's logon request to the system for authentication. A typical Windows NT system has multiple logon processes, one for each logon "path" (for example, system console, for network access, for remote access through serial line, etc.). Usually, these logon processes are registered at system startup time. But a logon process can also be registered when a new service is started (for example, when the remote access service is manually started). When this event happens, it usually indicates that Windows NT added one more logon "path" to the system. How to remove this vulnerability Determine whether the added logon process should be allowed and take appropriate actions. For example, if the remote access server is added as a logon process, you should determine whether remote access through serial line (modem) is allowed on that system. References ISS X-Force Logon process registered http://xforce.iss.net/static/2218.php Logon event by user with administrative privileges (Logon_with_admin_privileges) About this signature or vulnerability This signature detects that a user with administrative privileges has logged on to the system. Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 444 Logon event by user with special privileges (Logon_with_special_privileges) Systems affected Unix, Windows NT Type Host Sensor Vulnerability description Windows NT: The Windows NT administrator has the authority to grant important privileges to users and groups. Certain administrative privileges are normally granted only to users that have some system administrative duties. An administrator must grant these administrative privileges by using the Windows NT User Manager utility. For example, the right SeLoadDriverPrivilege allows a user to load and unload device drivers. Whenever a user who has been granted these administrative privileges logs on, an audit message is written into the Windows NT security log. Solaris: The "root" user is afforded primary system admin privileges in UNIX. This event notes when a root user has logged in using a conventional login, rlogin, telnet, ftp, or other login method. How to remove this vulnerability Windows NT/2000: Take note of logon activity of users who have been granted administrative privileges. Determine if those administrative privileges are necessary and whether an account has gained administrative privileges without proper administrative oversight. You can review the login history of accounts by running the login/logout history report. Solaris: Good security practice suggests that an administrator should only login as root when performing specific administrative functions that require root access. Do not perform other functions as root. The intent should be to make login as root an exception and not the norm. This ensures that a root login is an important activity and should always be attributable to some specific administrative activity. Hence when the root login event occurs, it is an immediate cause for concern if it can not be associated with legitimate administrative tasks. References ISS X-Force Logon event by user with administrative privileges http://xforce.iss.net/static/1517.php Logon event by user with special privileges (Logon_with_special_privileges) About this signature or vulnerability This signature detects a Windows security log message indicating that a user with special privileges has logged on to the system. Default risk level High Sensors that have this signature RealSecure OS Sensor: 3.0, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor 445 LOKI ICMP tunneling back door (Loki) Vulnerability description A Windows NT administrator has the authority to grant important privileges to users and groups. Certain special privileges are not granted to any user by default. An administrator must grant these special privileges by using the Windows NT User Manager utility. For example, the right SeAuditPrivilege allows the user to generate security audit log entries. Whenever a user who has been granted these special right-granting privileges logs on, an audit message is written into the Windows NT security log. How to remove this vulnerability Take note of logon activity by users who have been granted special privileges. Confirm that those special privileges are actually necessary for those users. Determine whether an account has gained special privileges without proper administrative oversight. You can review the login history of accounts by running the login/logout history report. References ISS X-Force Logon event by user with special privileges http://xforce.iss.net/static/1516.php LOKI ICMP tunneling back door (Loki) False positives RealSecure Network Sensor: A false positive is possible if RealSecure detects a particular number in the ICMP header of a ping packet, which could contain otherwise harmless data. RealSecure Server Sensor: A false positive is possible if RealSecure detects a particular number in the ICMP header of a ping packet, which could contain otherwise harmless data. Default risk level High Sensors that have this signature RealSecure Network Sensor: 3.01, RealSecure Server Sensor: 5.5 Systems affected FreeBSD: 2.1.x, Linux kernel: 2.0.x, OpenBSD: 2.1, Solaris: 2.5, Solaris: 2.6 Type Suspicious Activity Vulnerability description LOKI is a client/server program published in the online publication Phrack. This program is a working proof-of-concept to demonstrate that data can be transmitted somewhat secretly across a network by hiding it in traffic that normally does not contain payloads. The example code can tunnel the equivalent of a Unix RCMD/RSH session in either ICMP echo request (ping) packets or UDP traffic to the DNS port. This is used as a back door into a Unix system after root access has been compromised. Presence of LOKI on a system is evidence that the system has been compromised in the past. How to remove this vulnerability If the LOKI attack is crossing a perimeter router or firewall, add a rule that blocks all ICMP traffic entering your network. To determine if LOKI is running, look for programs that have an ICMP raw socket open. This can be done from a root shell on Linux with a command similar to: "netstat -a -n -w" If you see something like this: 446 Lotus Notes SMTP server can be crashed with long HELO commands (Email_Helo_Overflow) Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address State raw 0 0 0.0.0.0:1 0.0.0.0:* raw 0 0 0.0.0.0:1 0.0.0.0:* raw 0 0 0.0.0.0:255 0.0.0.0:* Some process has an ICMP raw socket open on the system, which might be indicative of a LOKI daemon. Also look for 0.0.0.0:17, which might indicate a loki daemon running in UDP mode. For Solaris, the command would be netstat -a -n -P icmp. Next, identify the loki server and kill the process. To kill the process, choose one of the following commands: Linux: ps -aux -w | grep "root" Solaris: /usr/ucb/ps -aux -w | grep "root" The default name is lokid, but this name could easily be changed to another name by an attacker. An active installation of lokid will often result in many zombie copies of the process left around, due to bugs in the program. This can be used as a clue. References Phrack Magazine, Volume 7, Issue 49, File 06 of 16 Project Loki http://packetstorm.securify.com/mag/phrack/phrack49/P49-06 Phrack Magazine, Volume 7, Issue 51, File 06 of 17 L O K I 2 (the implementation) http://packetstorm.securify.com/mag/phrack/phrack51/P51-06 ISS X-Force LOKI ICMP tunneling back door http://xforce.iss.net/static/1452.php Lotus Notes SMTP server can be crashed with long HELO commands (Email_Helo_Overflow) About this signature or vulnerability This vulnerability is detected by the Email_Helo_Overflow signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.1 Systems affected Lotus Notes Type Suspicious Activity Vulnerability description The Lotus Notes SMTP server is vulnerable to a denial of service attack. An attacker can send consecutive HELO commands with lengths longer than 2048 characters to crash the server. 447 Lotus Domino SMTP Server policy feature buffer overflow (Lotus_Domino_SMTP_Overflow) How to remove this vulnerability No remedy available as of June 2001. References BugTraq Mailing List, Thu Jan 14 1999 08:52:53 Lotus Notes SMTP Server bug http://www.securityfocus.com/archive/1/11952 ISS X-Force Lotus Notes SMTP server can be crashed with long HELO commands http://xforce.iss.net/static/1813.php Lotus Domino SMTP Server policy feature buffer overflow (Lotus_Domino_SMTP_Overflow) About this signature or vulnerability This signature detects a specially-crafted email for which the FROM field contains more than 4000 characters. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 3.1 Systems affected Lotus Domino R5: 5.0.1, Lotus Domino R5: 5.0.2, Lotus Domino R5: 5.0.3, Lotus Domino R5: 5.0.4, Lotus Domino R5: 5.0 Type Denial of Service Vulnerability description Lotus Domino SMTP Server versions 5.0 through 5.0.5 are vulnerable to a buffer overflow in the policy feature. The policy feature is used to define rules for server relaying. If the policy feature is enabled to check for the domain name, a remote attacker can overflow a buffer and crash the server or execute arbitrary code on the system with privileges of the user that the SMTP server is running as. How to remove this vulnerability Upgrade to the latest version of Lotus Domino SMTP Server (5.0.6 or later), available from the Notes.net Web site. See References. References S.A.F.E.R. Security Bulletin 010123.EXP.1.10 Buffer overflow in Lotus Domino SMTP Server http://www.safermag.com/advisories/0012.html Notes.net Web site version 5.06 download http://www.notes.net/r5fixlist.nsf/Progress/5.0.6?OpenDocument Notes/Domino Fix List Database SPR CMAS4NNLVG Fixed a potential denial of service attack. http://www.notes.net/r5fixlist.nsf/5c087391999d06e7852569280062619d/ 77317b8b83ceac0285256a5000737387?OpenDocument 448 LPRng syslog() call allows user supplied format strings (LPRng_Format_String) Lotus Customer Support Technote Domino R5 SMTP Server Buffer Overflows if Domain Restrictions are Enabled http://support.lotus.com/sims2.nsf/eb5fbc0ab175cf0885256560005206cf/ a05d4ad614858e0a852569e6005f1fc5?OpenDocument&Highlight=0,184329 CERT Vulnerability Note VU#666872 Buffer Overflow in Lotus Domino Mail Server http://www.kb.cert.org/vuls/id/666872 ISS X-Force Lotus Domino SMTP Server policy feature buffer overflow http://xforce.iss.net/static/5993.php CVE CVE-2001-0260 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0260 LPRng syslog() call allows user supplied format strings (LPRng_Format_String) About this signature or vulnerability This signature detects an LPR command (on TCP port 515) that contains a format specifier, which could indicate an attempt by an attacker to execute arbitrary code on the host. The actual command detected will be reported in the Raw Command information field. Default risk level High Sensors that have this signature RealSecure Network Sensor: XPU 2.2 Systems affected FreeBSD, TurboLinux, Caldera OpenLinux: 2.3, Caldera OpenLinux: 2.4, Red Hat Linux: 7.0 Type Unauthorized Access Attempt Vulnerability description The LPRng printer daemon in some Linux distributions is vulnerable to a format string attack. User-supplied input is passed to syslog() calls in LPRng that do not include format string arguments. An attacker can exploit this vulnerability to cause a segmentation fault and execute arbitrary code, possibly gaining root privileges. How to remove this vulnerability For Caldera OpenLinux: Upgrade to the latest version of LPRng (3.5.3-3 or later), as listed in Caldera Systems, Inc. Security Advisory CSSA-2000-033.0. See References. For Red Hat: Upgrade to the latest version of LPRng (3.6.24-2 or later), as listed in Red Hat, Inc. Security Advisory RHSA-2000:065-04. See References. For FreeBSD: Upgrade to the latest version of LPRng (3.6.25 or later), as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-00:56. See References. For TurboLinux: Upgrade to the latest version of LPRng (3.6.26-1 or later), as listed in TurboLinux Security Announcement TLSA2001001-1. See References. For other distributions: Contact your vendor for upgrade or patch information. 449 Mail-Max server allows remote execution of code through a buffer overflow (Email_Helo_Overflow) References Caldera Systems, Inc. Security Advisory CSSA-2000-033.0 format bug in LPRng http://www.calderasystems.com/support/security/advisories/CSSA-2000-033.0.txt BugTraq Mailing List, Tue Sep 26 2000 00:57:43 Format strings: bug #2: LPRng http://www.securityfocus.com/archive/1/85002 Red Hat Linux Errata Advisory RHSA-2000:065-04 LPRng contains a critical string format bug http://www.redhat.com/support/errata/RHSA-2000-065-06.html CERT Advisory CA-2000-22 Input Validation Problems in LPRng http://www.cert.org/advisories/CA-2000-22.html FreeBSD, Inc. Security Advisory FreeBSD-SA-00:56 LPRng contains potential root compromise ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:56.lprng.asc TurboLinux Security Announcement TLSA2001001-1 LPRng-3.6.26-1 http://www.turbolinux.com/pipermail/tl-security-announce/2001-January/ 000029.html CERT Vulnerability Note VU#382365 LPRng can pass user-supplied input as a format string parameter to syslog() calls http://www.kb.cert.org/vuls/id/382365 CIAC Information Bulletin L-025 LPRng Format String Vulnerability http://www.ciac.org/ciac/bulletins/l-025.shtml CIAC Information Bulletin L-004 FreeBSD LPRng Vulnerability http://www.ciac.org/ciac/bulletins/l-004.shtml ISS X-Force LPRng syslog() call allows user supplied format strings http://xforce.iss.net/static/5287.php CVE CAN-2000-0917 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0917 Mail-Max server allows remote execution of code through a buffer overflow (Email_Helo_Overflow) About this signature or vulnerability This vulnerability is detected by the Email_Helo_Overflow signature. Default risk level High 450 Windows 2000 user account mapped for logon (Mapped_account) Sensors that have this signature RealSecure Network Sensor: 3.1 Systems affected Mail-Max Type Suspicious Activity Vulnerability description SmartMax Software Mail-Max, an SMTP server Windows 95, Windows 98, and Windows NT platforms, is vulnerable to a buffer overflow in the server's handling of some SMTP commands. By exploiting this buffer overflow condition, a remote attacker could execute arbitrary code on the server with the privileges of the user owning the Mail-Max process. How to remove this vulnerability No remedy available as of June 2001. References BugTraq Mailing List, Sat Feb 13 1999 22:00:30 Mail-Max Remote Buffer Overflow Exploit http://www.securityfocus.com/archive/1/12505 SmartMax Software, Inc. Web site MailMax 2.0 http://www.smartmax.com/mailmax.html ISS X-Force Mail-Max server allows remote execution of code through a buffer overflow http://xforce.iss.net/static/1773.php CVE CVE-1999-0404 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0404 Windows 2000 user account mapped for logon (Mapped_account) About this signature or vulnerability This signature detects a Windows event log message indicating that a Windows 2000 account has been mapped by a client for logon. Default risk level Low Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Windows 2000 Type Host Sensor 451 Master's Paradise98 backdoor for Windows (Masters_Paradise98) Vulnerability description In order to enable a non-Windows 2000 Kerberos principal to log on to a Windows 2000 computer, the Kerberos principal must be mapped to a Windows 2000 user account. If the Kerberos principal is mapped to an inappropriate account, or is not authorized to log on to the Windows 2000 computer, it could enable an attacker to tamper with the Windows 2000 computer. How to remove this vulnerability Verify that the map account operation is authorized. If necessary, remove the mapped account using the Windows 2000 Active Directory Users and Computers snap-in. References ISS X-Force Windows 2000 user account mapped for logon http://xforce.iss.net/static/4873.php Map account operation failed (Mapped_account_failed) About this signature or vulnerability This signature detects a Windows event log message indicating that a client could not be mapped for logon. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: SR 1.1 Systems affected Windows 2000 Type Host Sensor Vulnerability description In order to enable a non-Windows 2000 Kerberos principal to log on to a Windows 2000 computer, the Kerberos principal must be mapped to a Windows 2000 user account. Frequent failures for a Kerberos principal to be mapped to a Windows 2000 account could indicate attempts by an attacker to tamper with the Windows 2000 computer. How to remove this vulnerability Determine the cause of the map account operation failure. If the account mapping is authorized, correct any problems and re-map the account. References ISS X-Force Map account operation failed http://xforce.iss.net/static/4881.php Master's Paradise98 backdoor for Windows (Masters_Paradise98) About this signature or vulnerability 452 This signature detects a TCP connection on port 31 to a Master's Paradise98 backdoor on your network. Master's Paradise98 backdoor for Windows (Masters_Paradise98) Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Master's Paradise98 backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Master's Paradise98 backdoor, an attacker can do the following: How to remove this vulnerability ● access your files and system registry ● manipulate the appearance of your desktop ● obtain your RAS (Remote Access Server) password (Windows NT only) The Master's Paradise backdoor can be very difficult to remove manually, because the executable is difficult to locate and identify on your system. Refer to the steps below for using an antivirus program to remove the backdoor. To use an antivirus program to remove the Master's Paradise backdoor: 1. If you do not have an antivirus program installed, download and install one of these virus scanners: ■ Norton AntiVirus: http://www.symantec.com/nav/indexA.html ■ McAfee VirusScan: http://software.mcafee.com/centers/download/ ■ Trend Micro PC-Cillin: http://www.trend.com/pc-cillin/ 2. Run the antivirus program to scan your system for this backdoor. The virus scanner should find and remove the Master's Paradise backdoor from your computer. References Big Chicken Computer Security Web site Masters Paradise http://members.xoom.com/_XOOM/big_chicken/trojans/masterpar/ Threats to your Security on the Internet The Basics of Master's Paradise http://www.commodon.com/threat/threat-mp.htm ISS X-Force Master's Paradise98 backdoor for Windows http://xforce.iss.net/static/4146.php 453 Maverick's Matrix backdoor for Windows 95/98 (MavericksMatrix) Maverick's Matrix backdoor for Windows 95/98 (MavericksMatrix) About this signature or vulnerability This signature detects a TCP connection on port 1269 to a Maverick's Matrix backdoor on your network. False negatives RealSecure Network Sensor: RealSecure detects a connection to the Maverick's Matrix backdoor only when the Maverick's Matrix backdoor uses its default port, port 1269. A false negative is possible if the Maverick's Matrix backdoor is configured to use a port other than 1269. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Maverick's Matrix backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Maverick's Matrix backdoor, an attacker can do the following: How to remove this vulnerability ● access files on your computer ● retrieve passwords ● start and stop an FTP server on your computer To remove the Maverick's Matrix backdoor from your computer: 1. Delete Wincfg.exe from the Windows system directory. 2. Using Regedit, find the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ Wincfg.exe=C:\<windows system>\wincfg.exe registry key. 3. Delete this registry key. References Maverick's Crew's Site Maverick's Crew's Site http://www.drive.to/Maverick ISS X-Force Maverick's Matrix backdoor for Windows 95/98 http://xforce.iss.net/static/3329.php 454 Millenium backdoor for Windows (Millenium) MDaemon SMTP server can be crashed with a long HELO (Email_Helo_Overflow) About this signature or vulnerability This vulnerability is detected by the Email_Helo_Overflow signature. Default risk level Medium Sensors that have this signature RealSecure Network Sensor: 3.1 Systems affected MDaemon Type Suspicious Activity Vulnerability description MDaemon is a multi-protocol mail server developed by Alt-N Technologies for Microsoft Windows systems. A vulnerability in versions of MDaemon up to 2.7.1 could allow a remote attacker to crash the server by sending a HELO command with a very large argument. To regain normal functionality, the server must be manually restarted. How to remove this vulnerability Upgrade to the latest version of MDaemon (2.7.1, SP2 or later), available from the MDaemon Download Page. See References. References MDaemon Download Page MDaemon POP3/SMTP Server for Windows http://www.mdaemon.com/download.cfm BugTraq Mailing List, Tue Mar 10 1998 22:44:45 MDaemon SMTP Server Buffer Overflow's http://www.securityfocus.com/archive/1/8741 Rootshell Web site MDaemon buffer overflow http://www.rootshell.com/archive-j457nxiqi3gq59dv/199803/mdaemon.c.html ISS X-Force MDaemon SMTP server can be crashed with a long HELO http://xforce.iss.net/static/1834.php Millenium backdoor for Windows (Millenium) About this signature or vulnerability This signature detects a TCP connection on port 20001 to a Millenium backdoor on your network. Default risk level High 455 Mountd export (MountdExport) Sensors that have this signature RealSecure Network Sensor: 5.0 Systems affected Windows NT, Windows 95, Windows 98 Type Unauthorized Access Attempt Vulnerability description The Millenium backdoor is one of many backdoor programs that attackers can use to access your computer system without your knowledge or consent. With the Millenium backdoor, an attacker can do the following: How to remove this vulnerability ● log keystrokes ● capture an image of your screen ● execute programs ● send messages to you that appear on your screen To remove the Millenium backdoor from your computer: 1. Using Regedit, find the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. 2. Find the registry entry named Millenium that has a data value of C:\Windows\System\Reg66.exe. 3. Delete that registry entry. 4. Delete Reg66.exe from the Windows system directory. 5. Open the win.ini file in your Windows directory. 6. Find and delete the line "run=c:\windows\system\reg66.exe" from win.ini. References ISS X-Force Millenium backdoor for Windows http://xforce.iss.net/static/3111.php Mountd export (MountdExport) About this signature or vulnerability This signature detects a remote showmount, which is a user request for a list of file systems that are exported by the Network File System (NFS). This signature can assist in understanding patterns of NFS file sharing on your network. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected NFS Type Suspicious Activity 456 Microsoft SQL 6.5 Server shutdown (MSSQL65_Shutdown) Vulnerability description A showmount command is a user request for a list of file systems that are exported by the Network File System (NFS). Use of the showmount command should only occur inside an organization. Export requests from external sources should be considered suspicious. How to remove this vulnerability If the source of the showmount is internal, consider querying the users to determine who has been mounting file systems and why. If this event was caused by an outside host, consider blocking access to that host. References ISS X-Force Mountd export http://xforce.iss.net/static/663.php Mountd mount request (MountdMnt) About this signature or vulnerability This signature detects a Network File System (NFS) mount request and records the file systems that a user mounts, allowing you to construct patterns of NFS file sharing. Default risk level Low Sensors that have this signature RealSecure Network Sensor: 1.0 Systems affected NFS Type Suspicious Activity Vulnerability description A Network File System (NFS) mount request is used to mount a remote file systems for the purpose of NFS file sharing. Mount requests typically occur when a system boots. It is possible but fairly unlikely that a user might independently mount a file system. Mount events from systems that have been running for a long time (several hours or more) are suspicious. Typically, this event should never be caused by an external host mounting one of your file systems. How to remove this vulnerability This event might suggest that the source host has just restarted. If the source has not restarted recently (as reported by uptime), query the users to determine who has been mounting file systems and why. If this event was caused by an outside host, consider blocking access to that host. References ISS X-Force Mountd mount request http://xforce.iss.net/static/664.php Microsoft SQL 6.5 Server shutdown (MSSQL65_Shutdown) About this signature or vulnerability This signature detects that the SQL Server 6.5 database server process has been shut down. 457 Microsoft SQL Server 6.5 started (MSSQL65_Startup) Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Microsoft SQL Server: 6.5 Type Host Sensor Vulnerability description The SQL Server database server process has been shut down. How to remove this vulnerability Most process-oriented activities are a part of normal administrative functions. Determine the role of this database and how critical it is in your business activities. This process may have been shut down for software or hardware upgrades, diagnostics, or other maintenance functions. If this is a production database server, closely monitor startup and shutdown activity to prevent availability and integrity problems. Verify that all administrative activities are monitored and retained in an audit history. If there is no legitimate reason for a shutdown to occur, if shutdowns occur from unexpected or non-administrative accounts, or if shutdowns occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Microsoft SQL 6.5 Server shutdown http://xforce.iss.net/static/3220.php Microsoft SQL Server 6.5 started (MSSQL65_Startup) About this signature or vulnerability This signature detects that the SQL Server 6.5 database server process is starting. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Microsoft SQL Server: 6.5 Type Host Sensor Vulnerability description The SQL Server database server process is starting. How to remove this vulnerability Most process-oriented activities are a part of normal administrative functions. Determine the role of this database and how critical it is in your business activities. This database 458 Microsoft SQL Server 6.5 non-trusted connection successful (MSSQL65_Successful_Non-Trusted_Connection) may have been started for testing, troubleshooting, or development functions, or restarted for software or hardware upgrades, diagnostics, or other maintenance functions. Verify that all administrative activities are monitored and retained in an audit history. If there is no legitimate reason for this database, if database processes activate from unexpected or non-administrative accounts, or if database startups occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Microsoft SQL Server 6.5 started http://xforce.iss.net/static/3219.php Microsoft SQL Server 6.5 non-trusted connection successful (MSSQL65_Successful_Non-Trusted_Connection) About this signature or vulnerability This signature detects that a non-trusted connection has successfully been established to the Microsoft SQL Server 6.5 database. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Microsoft SQL Server: 6.5 Type Host Sensor Vulnerability description A non-trusted connection has successfully been established to the Microsoft SQL Server database. How to remove this vulnerability Most connection activity is normal for accessing a database. Determine the role of this database and how critical it is in your business activities. This database may have been started for production, testing, troubleshooting, or development functions. The function of the database could help determine who should be connecting, how often, and at what times of the day. Verify that all activities are monitored and retained in an audit history. If there is no legitimate reason for a particular user to be connecting to this database, if database activity originates from unexpected user accounts, or if database accesses occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Microsoft SQL Server 6.5 non-trusted connection successful http://xforce.iss.net/static/3221.php 459 Microsoft SQL Server started (MSSQL7_Startup) Microsoft SQL Server shutdown (MSSQL7_Shutdown) About this signature or vulnerability This signature detects that the SQL Server 7.0 database server process has been shut down. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Microsoft SQL Server: 7.0, Microsoft SQL Server: 6.5, Microsoft SQL Server: 2000 Type Host Sensor Vulnerability description The SQL Server database server process has been shut down. How to remove this vulnerability Most process-oriented activities are a part of normal administrative functions. Determine the role of this database and how critical it is in your business activities. This process may have been shut down for software or hardware upgrades, diagnostics, or other maintenance functions. If this is a production database server, closely monitor startup and shutdown activity to prevent availability and integrity issues. Verify that all administrative activities are monitored and retained in an audit history. If there is no legitimate reason for a shutdown to occur, if shutdowns occur from unexpected or non-administrative accounts, or if shutdowns occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Microsoft SQL Server shutdown http://xforce.iss.net/static/3216.php Microsoft SQL Server started (MSSQL7_Startup) About this signature or vulnerability This signature detects that the SQL Server 7.0 database server process is starting. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Microsoft SQL Server: 7.0, Microsoft SQL Server: 6.5, Microsoft SQL Server: 2000 Type Host Sensor 460 Microsoft SQL Server non-trusted connection successful (MSSQL7_Successful_Non-Trusted_Connection) Vulnerability description The SQL Server database server process is starting. How to remove this vulnerability Most process-oriented activities are a part of normal administrative functions. Determine the role of this database and how critical it is in your business activities. This database may have been started for testing, troubleshooting, or development functions, or restarted for software or hardware upgrades, diagnostics, or other maintenance functions. Verify that all administrative activities are monitored and retained in an audit history. If there is no legitimate reason for this database, if database processes activate from unexpected or non-administrative accounts, or if database startups occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Microsoft SQL Server started http://xforce.iss.net/static/3215.php Microsoft SQL Server non-trusted connection successful (MSSQL7_Successful_Non-Trusted_Connection) About this signature or vulnerability This signature detects that a non-trusted connection has successfully been established to the Microsoft SQL Server 7.0 database. Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Microsoft SQL Server: 7.0, Microsoft SQL Server: 6.5, Microsoft SQL Server: 2000 Type Host Sensor Vulnerability description A non-trusted connection has successfully been established to the Microsoft SQL Server database. How to remove this vulnerability Most connection activity is normal for accessing a database. Determine the role of this database and how critical it is in your business activities. This database may have been started for production, testing, troubleshooting, or development functions. The function of the database could help determine who should be connecting, how often, and at what times of the day. Verify that all activities are monitored and retained in an audit history. If there is no legitimate reason for a particular user to be connecting to this database, if database activity originates from unexpected user accounts, or if database accesses occur at unusual times, then this activity may be an indication of misuse. 461 Microsoft SQL Server shutdown (MSSQL_Shutdown) References ISS X-Force Microsoft SQL Server non-trusted connection successful http://xforce.iss.net/static/3217.php Microsoft SQL Server failed connection (MSSQL_Failed_Connection) Default risk level Medium Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A connection failed to be established to the Microsoft SQL Server database server. How to remove this vulnerability A single or sporadic connection failure may be normal, and could be caused by an errant connection attempt. Your audit history can help you determine if a pattern exists and whether the pattern is an indicator of unauthorized access. Most connection activity is normal for accessing a database. Determine the role of this database and how critical it is in your business activities. This database may have been started for production, testing, troubleshooting, or development functions, which would determine who should be connecting, how often, and at what times of the day. Verify that all activities are monitored and retained in an audit history. If there is no legitimate reason for a particular user to be connecting to this database, if database activity originates from unexpected user accounts, or if database accesses occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Microsoft SQL Server failed connection http://xforce.iss.net/static/3218.php Microsoft SQL Server shutdown (MSSQL_Shutdown) About this signature or vulnerability This signature detects that the SQL Server database server process has been shut down. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.5 462 Microsoft SQL Server started (MSSQL_Startup) Systems affected Microsoft SQL Server: 7.0, Microsoft SQL Server: 6.5, Microsoft SQL Server: 2000 Type Host Sensor Vulnerability description The SQL Server database server process has been shut down. How to remove this vulnerability Most process-oriented activities are a part of normal administrative functions. Determine the role of this database and how critical it is in your business activities. This process may have been shut down for software or hardware upgrades, diagnostics, or other maintenance functions. If this is a production database server, closely monitor startup and shutdown activity to prevent availability and integrity issues. Verify that all administrative activities are monitored and retained in an audit history. If there is no legitimate reason for a shutdown to occur, if shutdowns occur from unexpected or non-administrative accounts, or if shutdowns occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Microsoft SQL Server shutdown http://xforce.iss.net/static/3216.php Microsoft SQL Server started (MSSQL_Startup) About this signature or vulnerability This signature detects that the SQL Server database server process is starting. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft SQL Server: 7.0, Microsoft SQL Server: 6.5, Microsoft SQL Server: 2000 Type Host Sensor Vulnerability description The SQL Server database server process is starting. How to remove this vulnerability Most process-oriented activities are a part of normal administrative functions. Determine the role of this database and how critical it is in your business activities. This database may have been started for testing, troubleshooting, or development functions, or restarted for software or hardware upgrades, diagnostics, or other maintenance functions. Verify that all administrative activities are monitored and retained in an audit history. If there is no legitimate reason for this database, if database processes activate from unexpected or non-administrative accounts, or if database startups occur at unusual times, then this activity may be an indication of misuse. 463 Microsoft SQL Server trusted connection successful (MSSQL_Successful_Trusted_Connection) References ISS X-Force Microsoft SQL Server started http://xforce.iss.net/static/3215.php Microsoft SQL Server non-trusted connection successful (MSSQL_Successful_Non-Trusted_Connection) About this signature or vulnerability This signature detects that a non-trusted connection has successfully been established to the Microsoft SQL Server database. Default risk level Medium Sensors that have this signature RealSecure Server Sensor: 6.5 Systems affected Microsoft SQL Server: 7.0, Microsoft SQL Server: 6.5, Microsoft SQL Server: 2000 Type Host Sensor Vulnerability description A non-trusted connection has successfully been established to the Microsoft SQL Server database. How to remove this vulnerability Most connection activity is normal for accessing a database. Determine the role of this database and how critical it is in your business activities. This database may have been started for production, testing, troubleshooting, or development functions. The function of the database could help determine who should be connecting, how often, and at what times of the day. Verify that all activities are monitored and retained in an audit history. If there is no legitimate reason for a particular user to be connecting to this database, if database activity originates from unexpected user accounts, or if database accesses occur at unusual times, then this activity may be an indication of misuse. References ISS X-Force Microsoft SQL Server non-trusted connection successful http://xforce.iss.net/static/3217.php Microsoft SQL Server trusted connection successful (MSSQL_Successful_Trusted_Connection) About this signature or vulnerability This signature detects that a trusted connection has successfully been established to the Microsoft SQL Server database. Default risk level Medium 464 mstream distributed denial of service tool (master detected) (Mstream_Master) Sensors that have this signature RealSecure OS Sensor: 3.2, RealSecure Server Sensor: 5.5 Systems affected Windows NT Type Host Sensor Vulnerability description A trusted connection has successfully been established to the Microsoft SQL Server database. How to remove this vulnerability Trusted connections are most often used between computers in different domains, or for processes that require special access to database processes. Determine if this account should be allowed to establish trusted connections, or whether these connections occurred during an appropriate time interval. If this is not an authorized administrative account, consider limiting access for this account. References ISS X-Force Microsoft SQL Server trusted connection successful http://xforce.iss.net/static/3214.php mstream distributed denial of service tool (master detected) (Mstream_Master) About this signature or vulnerability This signature detects a connection to an mstream master program on TCP port 12754, 6723, or 15104. False negatives RealSecure Network Sensor: RealSecure detects a connection to the mstream master program only when the mstream master uses its default ports, TCP ports 12754, 6723, or 15104. A false negative is possible if the mstream master program is configured to use ports other than 12754, 6723, or 15104. RealSecure Server Sensor: RealSecure detects a connection to the mstream master program only when the mstream master uses its default ports, TCP ports 12754, 6723, or 15104. A false negative is possible if the mstream master program is configured to use ports other than 12754, 6723, or 15104. Default risk level High Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected Any Type Suspicious Activity Vulnerability description The mstream program is a distributed denial of service tool based on the "stream.c" attack. This tool includes a "master controller" and a "zombie." The master controller is the 465 mstream distributed denial of service tool (master detected) (Mstream_Master) portion of the tool that controls all of the zombie agents. An attacker connects to the master controller using telnet to control the zombies. Communications between the client, master, and zombie are not encrypted. Using a slightly modified version of the stream.c attack, the zombie slows a computer down by using up CPU cycles. The attack also consumes network bandwidth. In addition to the incoming ACK packets, the target host will consume bandwidth when it tries to send TCP RST packets to non-existent IP addresses. Routers will then return ICMP host/ network unreachable packets to the victim, resulting in more bandwidth starvation. The distributed method of attack multiplies the effect on the CPU, as well as consuming large amounts of network bandwidth. How to remove this vulnerability Locate the mstream master or zombie on a system, by using strings or lsof. If you know which port the master controller is listening on, you can use lsof to locate the executable. After locating the mstream master or zombie, kill the process and delete the executable. From the master controller, locate the zombie computers that are registered with the master to find other systems that have been compromised. To locate the mstream master or zombie on a system using strings: 1. Type the following command for each filesystem on the computer, replacing / with the filesystem you want to search: find / -mount -type f -print | xargs grep -l newserver Note: This command could take up to thirty minutes to run on your system, depending on the size of the filesystem and the speed of the computer. 2. Verify each file found by using the strings command on it, because the search may find files that are not part of mstream, such as /usr/bin/xchat. 3. Compare the strings output to the expected strings output for the master and the zombie, as listed below. The strings output of the zombie, from server.c, should contain the following text: Must be ran as root. socket bind setsockopt newserver stream mstream ping pong fork Forked into background, pid %d The strings output of the master should contain the following text: Connection from %s newserver New server on %s. pong Got pong number %d from %s %s has disconnected (not auth'd): %s Invalid password from %s. Password accepted for connection from %s. Lost connection to %s: %s To locate the mstream master or zombie on a system using lsof: 1. Type the following command, replacing "port" with the port number on which the master executable is listening: lsof -i TCP:port 2. Compare the output to the following output to locate the process that is listening on the specified TCP port: [root@berry]# lsof -i TCP:12754 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME mstream 3664 juser 3u IPv4 721759 TCP *:12754 (LISTEN) 3. Type the following command, replacing "process" with the name of process determined in step 2: lsof -c process -a -d txt 4. Compare the output to the following output, to find the path to the executable: [root@berry]# lsof -c mstream -a -d txt COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME mstream 3664 juser txt REG 8,1 33185 306211 /home/juser/ mstream 466 mstream distributed denial of service tool (zombie detected) (Mstream_Zombie) To kill the process and delete the executable: 1. Determine the process ID for the process. To obtain the PID: ■ If you know the name of the process, use the 'ps' command. ■ If you know the port number that the process is using, use lsof. 2. Kill the process using the 'kill' command and the process ID. 3. Delete the mstream executable. To locate all the zombie systems registered to the master: 1. Locate the "..." or ".sr" file, which includes an encrypted list of IP addresses of all of the zombies. 2. Decrypt the file using the following shell command, replacing "..." with ".sr", depending on the file you are attempting to decrypt: [root@berry]# cat ... | tr 'b-k`' '09.' | sed 's/<$//' 31.3.3.7 Inform your ISP of the attack, so that they can take action to further prevent the attack from spreading. References Internet Security Systems Security Alert #48 "mstream" Distributed Denial of Service Tool http://xforce.iss.net/alerts/advise48.php ISS X-Force mstream distributed denial of service tool (master detected) http://xforce.iss.net/static/4371.php CVE CAN-2000-0138 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0138 mstream distributed denial of service tool (zombie detected) (Mstream_Zombie) About this signature or vulnerability This signature detects communications between an mstream master and zombie using UDP port 10498, 7983, 6838, or 9325. False negatives RealSecure Network Sensor: RealSecure detects communications between the mstream master and zombie only when the mstream zombie program uses its default UDP ports of 10498, 7983, 6838, or 9325. A false negative is possible if the mstream program is configured to use a port other than port 10498, 7983, 6838, or 9325. RealSecure Server Sensor: RealSecure detects communications between the mstream master and zombie only when the mstream zombie program uses its default UDP ports of 10498, 7983, 6838, or 9325. A false negative is possible if the mstream program is configured to use a port other than port 10498, 7983, 6838, or 9325. Default risk level High 467 mstream distributed denial of service tool (zombie detected) (Mstream_Zombie) Sensors that have this signature RealSecure Network Sensor: 5.0, RealSecure Server Sensor: 5.5.2 Systems affected Any Type Suspicious Activity Vulnerability description The mstream program is a distributed denial of service tool based on the "stream.c" attack.This tool includes a "master controller" and a "zombie." The master controller is the portion of the tool that controls all of the zombie agents. An attacker connects to the master controller using telnet to control the zombies. Communications between the client, master, and zombie are not encrypted. Using a slightly modified version of the stream.c attack, the zombie slows a computer down by using up CPU cycles. The attack also consumes network bandwidth. In addition to the incoming ACK packets, the target host will consume bandwidth when it tries to send TCP RST packets to non-existent IP addresses. Routers will then return ICMP host/ network unreachable packets to the victim, resulting in more bandwidth starvation. The distributed method of attack multiplies the effect on the CPU, as well as consuming large amounts of network bandwidth. How to remove this vulnerability Locate the mstream master or zombie on a system, by using strings or lsof. If you know which port the master controller is listening on, you can use lsof to locate the executable. After locating the mstream master or zombie, kill the process and delete the executable. From the master controller, locate the zombie computers that are registered with the master to find other systems that have been compromised. To locate the mstream master or zombie on a system using strings: 1. Type the following command for each filesystem on the computer, replacing / with the filesystem you want to search: find / -mount -type f -print | xargs grep -l newserver Note: This command could take up to thirty minutes to run on your system, depending on the size of the filesystem and the speed of the computer. 2. Verify each file found by using the strings command on it, because the search may find files that are not part of mstream, such as /usr/bin/xchat. 3. Compare the strings output to the expected strings output for the master and the zombie, as listed below. The strings output of the zombie, from server.c, should contain the following text: Must be ran as root. socket bind setsockopt newserver stream mstream ping pong fork Forked into background, pid %d The strings output of the master should contain the following text: Connection from %s newserver New server on %s. pong Got pong number %d from %s %s has disconnected (not auth'd): %s Invalid password from %s. Password accepted for connection from %s. Lost connection to %s: %s To locate the mstream master or zombie on a system using lsof: 1. Type the following command, replacing "port" with the port number on which the master executable is listening: lsof -i TCP:port 2. Compare the output to the following output to locate the process that is listening on the specified TCP port: [root@berry]# lsof -i TCP:12754 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME mstream 3664 juser 3u IPv4 721759 TCP *:12754 (LISTEN) 468 Napster client update (Napster_Client_Update) 3. Type the following command, replacing "process" with the name of process determined in step 2: lsof -c process -a -d txt 4. Compare the output to the following output, to find the path to the executable: [root@berry]# lsof -c mstream -a -d txt COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME mstream 3664 juser txt REG 8,1 33185 306211 /home/juser/ mstream To kill the process and delete the executable: 1. Determine the process ID for the process. To obtain the PID: ■ If you know the name of the process, use the 'ps' command. ■ If you know the port number that the process is using, use lsof. 2. Kill the process using the 'kill' command and the process ID. 3. Delete the mstream executable. To locate all the zombie systems registered to the master: 1. Locate the "..." or ".sr" file, which includes an encrypted list of IP addresses of all of the zombies. 2. Decrypt the file using the following shell command, replacing "..." with ".sr", depending on the file you are attempting to decrypt: [root@berry]# cat ... | tr 'b-k`' '09.' | sed 's/<$//' 31.3.3.7 Inform your ISP of the attack, so that they can take action to further prevent the attack from spreading. References Internet Security Systems Security Alert #48 "mstream" Distributed Denial of Service Tool http://xforce.iss.net/alerts/advise48.php ISS X-Force mstream distributed denial of service tool (zombie detected) http://xforce.iss.net/static/4370.php CVE CAN-2000-0138 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0138 Napster client update (Napster_Client_Update) About this signature or vulnerability This signature detects a connection between a Napster client and a Napster server for the purpose of updating the Napster client. Default risk level Low Sensors that have this signature RealSecure Network Sensor: SR 1.1 Systems affected Napster 469 Napster long command (Napster_Command_Long) Type Suspicious Activity Vulnerability description A connection between a Napster client and a Napster server for the purpose of updating the Napster client has been detected. Napster is an application that helps users locate, upload, and download MP3 music files over the Internet. The Napster client downloads and installs new versions of the client when it receives a message to do so from a Napster server. It could be possible for an attacker who has taken control of a Napster server to direct Napster clients to download potentially damaging files or programs. How to remove this vulnerability If use of the Napster application is not in compliance with your system policy, consider terminating the connection associated with this Napster event. It may be helpful to remind users of your system policy regarding the use of Napster or similar applications. References Napstes Web site Napster http://www.napster.com/ ISS X-Force Napster client update http://xforce.iss.net/static/4372.php Napster long command (Napster_Command_Long) About this signature or vulnerability This signature has been removed from RealSecure Network Sensor in XPU 3.1, due to a large number of false positives. This signature appears in the Policy Editor; however, it will not fire under any condition. As an alternative, you should use the other Napster signatures in RealSecure to detect the use of Napster on your network. Napster can introduce many different vulnerabilities on your network, and your security policy should not permit it to be used. False positives RealSecure Network Sensor: This si